From: Daniel Borkmann <daniel@iogearbox.net>
To: "Ricardo B. Marlière" <rbm@suse.com>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"John Fastabend" <john.fastabend@gmail.com>,
"Stanislav Fomichev" <sdf@fomichev.me>,
"Alexei Starovoitov" <ast@kernel.org>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Song Liu" <song@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"KP Singh" <kpsingh@kernel.org>, "Hao Luo" <haoluo@google.com>,
"Jiri Olsa" <jolsa@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Simon Horman" <horms@kernel.org>,
"Toke Høiland-Jørgensen" <toke@redhat.com>,
"David Ahern" <dsahern@kernel.org>,
"Jay Vosburgh" <jv@jvosburgh.net>,
"Andrew Lunn" <andrew+netdev@lunn.ch>,
"Hangbin Liu" <liuhangbin@gmail.com>
Cc: Fernando Fernandez Mancera <fmancera@suse.de>,
bpf@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net v4 4/4] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled
Date: Wed, 11 Mar 2026 06:49:07 +0100 [thread overview]
Message-ID: <2fef1df2-b43c-4083-baaa-c49f77227066@iogearbox.net> (raw)
In-Reply-To: <20260307-net-nd_tbl_fixes-v4-4-e2677e85628c@suse.com>
On 3/7/26 9:50 PM, Ricardo B. Marlière wrote:
> When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
> initialized because inet6_init() exits before ndisc_init() is called which
> initializes it. If bpf_redirect_neigh() is called with explicit AF_INET6
> nexthop parameters, __bpf_redirect_neigh_v6() can skip the IPv6 FIB lookup
> and call bpf_out_neigh_v6() directly. bpf_out_neigh_v6() then calls
> ip_neigh_gw6(), which uses ipv6_stub->nd_tbl.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000248
> Oops: Oops: 0000 [#1] SMP NOPTI
> RIP: 0010:skb_do_redirect+0x44f/0xf40
> Call Trace:
> <TASK>
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? __tcf_classify.constprop.0+0x83/0x160
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? tcf_classify+0x2b/0x50
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? tc_run+0xb8/0x120
> ? srso_alias_return_thunk+0x5/0xfbef5
> __dev_queue_xmit+0x6fa/0x1000
> ? srso_alias_return_thunk+0x5/0xfbef5
> packet_sendmsg+0x10da/0x1700
> ? srso_alias_return_thunk+0x5/0xfbef5
> __sys_sendto+0x1f3/0x220
> __x64_sys_sendto+0x24/0x30
> do_syscall_64+0x101/0xf80
> ? exc_page_fault+0x6e/0x170
> ? srso_alias_return_thunk+0x5/0xfbef5
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> Fix this by adding an early check in bpf_out_neigh_v6(). If IPv6 is
> disabled, drop the packet before neighbor lookup.
>
> Suggested-by: Fernando Fernandez Mancera <fmancera@suse.de>
> Fixes: ba452c9e996d ("bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop")
> Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
next prev parent reply other threads:[~2026-03-11 5:49 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-07 20:50 [PATCH net v4 0/4] {net,bpf}: nd_tbl fixes for when ipv6.disable=1 Ricardo B. Marlière
2026-03-07 20:50 ` [PATCH net v4 1/4] ipv6: move the disable_ipv6_mod knob to core code Ricardo B. Marlière
2026-03-07 20:50 ` [PATCH net v4 2/4] net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled Ricardo B. Marlière
2026-03-09 0:50 ` Hangbin Liu
2026-03-07 20:50 ` [PATCH net v4 3/4] bpf: bpf_out_neigh_v4: " Ricardo B. Marlière
2026-03-11 5:47 ` Daniel Borkmann
2026-03-07 20:50 ` [PATCH net v4 4/4] bpf: bpf_out_neigh_v6: " Ricardo B. Marlière
2026-03-11 5:49 ` Daniel Borkmann [this message]
2026-03-11 0:58 ` [PATCH net v4 0/4] {net,bpf}: nd_tbl fixes for when ipv6.disable=1 Jakub Kicinski
2026-03-11 5:50 ` Daniel Borkmann
2026-03-12 0:53 ` Jakub Kicinski
2026-03-12 1:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2fef1df2-b43c-4083-baaa-c49f77227066@iogearbox.net \
--to=daniel@iogearbox.net \
--cc=andrew+netdev@lunn.ch \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=fmancera@suse.de \
--cc=haoluo@google.com \
--cc=horms@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=jv@jvosburgh.net \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liuhangbin@gmail.com \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=rbm@suse.com \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=toke@redhat.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®