[PATCH net] net: ipv6: reject collect_md tunnel route without inet6_dev

[PATCH net] net: ipv6: reject collect_md tunnel route without inet6_dev

[Yingjie Wang]

ip6_tnl_xmit() selects an outer source address for a collect_md tunnel
with an unspecified metadata source by dereferencing
ip6_dst_idev(dst)->dev.

A route using a nexthop object can remain after its output device loses
its inet6_dev when its MTU is lowered below IPV6_MIN_MTU. The route still
has no error, so ip6_route_output() returns it with rt6i_idev == NULL.

An unprivileged user with CAP_NET_ADMIN in a private user and network
namespace can create this state and send an encapsulated packet through
an external ip6tnl device. The unchecked dereference then causes a NULL
pointer dereference in ip6_tnl_xmit(). With panic_on_oops enabled, this
panics the host.

A similar missing inet6_dev check was fixed in
commit 1b9b5323725e ("netfilter: ip6t_rpfilter: reject routes
without inet6_dev").

However, the collect_md transmit path in ip6_tnl_xmit()
still dereferences ip6_dst_idev(dst)->dev without checking
whether the route has an associated inet6_dev.

Check the route's inet6_dev before using its device. The unmodified
net/main KASAN kernel reproduced the NULL dereference, and the same
reproducer on the fixed kernel rejected the packet without a KASAN report,
oops, or panic. The fixed kernel also passed the ip6_tunnel.sh selftest.

Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnels")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
---
 net/ipv6/ip6_tunnel.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 64a184bca467..547c23c3121b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1187,10 +1187,14 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 			dst = NULL;
 			goto tx_err_link_failure;
 		}
-		if (t->parms.collect_md && ipv6_addr_any(&fl6->saddr) &&
-		    ipv6_dev_get_saddr(net, ip6_dst_idev(dst)->dev,
-				       &fl6->daddr, 0, &fl6->saddr))
-			goto tx_err_link_failure;
+		if (t->parms.collect_md && ipv6_addr_any(&fl6->saddr)) {
+			struct inet6_dev *idev = ip6_dst_idev(dst);
+
+			if (!idev ||
+			    ipv6_dev_get_saddr(net, idev->dev, &fl6->daddr,
+					       0, &fl6->saddr))
+				goto tx_err_link_failure;
+		}
 		ndst = dst;
 	}
 

base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
-- 
2.43.0

Re: [PATCH net] net: ipv6: reject collect_md tunnel route without inet6_dev

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net: ipv6: reject collect_md tunnel route without inet6_dev

[Alexei Starovoitov]

On Sat, Nov 07, 2026 at 07:29 AM Yingjie Wang <1075151112@qq.com> wrote:
> A route using a nexthop object can remain after its output device loses
> its inet6_dev when its MTU is lowered below IPV6_MIN_MTU. The route still
> has no error, so ip6_route_output() returns it with rt6i_idev == NULL.

since so, should it be fixed in there?

This is the fifth check of the same pointer:

  commit        function
  ------------  --------------------------
  d101291b2681  __fib6_rule_action()
  4db783d68b9b  ip6_output()
  d46401052c2d  xfrm6_get_saddr()
  1b9b5323725e  rpfilter_lookup_reverse6()
  this patch    ip6_tnl_xmit()

Three more callers still dereference it without a check:
__ip_vs_route_output_v6(), validate_ipv6_net_dev(), cxgb_find_route6().
When the same mistake is made in N places the interface is the problem.

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 616b86f..e4834e1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1151,6 +1151,12 @@ static void ip6_rt_init_dst(struct rt6_info *rt, const struct fib6_result *res)
 		return;
 	}

+	/* addrconf_ifdown() removed inet6_dev. The device can't do IPv6. */
+	if (!rt->rt6i_idev) {
+		ip6_rt_init_dst_reject(rt, RTN_UNREACHABLE);
+		return;
+	}
+
 	rt->dst.error = 0;
 	rt->dst.output = ip6_output;

@@ -1186,10 +1192,10 @@ static void ip6_rt_copy_init(struct rt6_info *rt, const struct fib6_result *res)
 	const struct net_device *dev = nh->fib_nh_dev;
 	struct fib6_info *f6i = res->f6i;

+	rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
 	ip6_rt_init_dst(rt, res);

 	rt->rt6i_dst = f6i->fib6_dst;
-	rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
 	rt->rt6i_flags = res->fib6_flags;
 	if (nh->fib_nh_gw_family) {
 		rt->rt6i_gateway = nh->fib_nh_gw6;