[BUG] net/ipv6: NULL pointer dereference in ip6_rt_copy_init()

We found a bug reachable in:

    path    net/ipv6/netfilter
    crash   NULL pointer dereference in ip6_rt_copy_init()
    commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: [email protected]

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/459f67f4d8af8ce6/patch.diff
        report.md   https://bugs.sh/b/459f67f4d8af8ce6/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        [email protected]

== Environment =========================================================
    Reproduced on  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
    VM setup       https://bugs.sh/b/459f67f4d8af8ce6/run.sh
    config         https://bugs.sh/b/459f67f4d8af8ce6/config.gz
    poc            https://bugs.sh/b/459f67f4d8af8ce6/repro.c

== Sanitizer Report ====================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 1000 PID: 5001 Comm: exploit Not tainted 7.2.0-15884-g2f38e26a5741 #66 PREEMPT(full)
RIP: 0010:rpfilter_lookup_reverse6 (net/ipv6/netfilter/ip6t_rpfilter.c:75) (inlined by) rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:105)
Call Trace:
<IRQ>
ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
nf_hook_slow (./include/linux/netfilter.h:165 net/netfilter/core.c:619)
nf_hook.constprop.0 (./include/linux/rcupdate.h:850 (discriminator 7) ./include/linux/netfilter.h:249 (discriminator 7))
ipv6_rcv (./include/linux/netfilter.h:323 net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6264 (discriminator 1))
__netif_receive_skb (net/core/dev.c:6377)
process_backlog (net/core/dev.c:6728)
__napi_poll.constprop.0 (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
do_softirq (kernel/softirq.c:546 (discriminator 20) kernel/softirq.c:533 (discriminator 20))
</IRQ>
__local_bh_enable_ip (kernel/softirq.c:473)
__dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 1) ./include/linux/rcupdate.h:923 (discriminator 1) net/core/dev.c:4961 (discriminator 1))
packet_xmit (./include/linux/netdevice.h:3461 net/packet/af_packet.c:277)
packet_sendmsg (net/packet/af_packet.c:3111 net/packet/af_packet.c:3143)
__sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 (discriminator 1) net/socket.c:2281 (discriminator 1))
__x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x4266e7
Kernel panic - not syncing: Fatal exception in interrupt


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to [email protected]

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup