[PATCH] net: bridge: fix NULL dereference in br_do_suppress_nd when ipv6.disable=1

From: Maximilian Pezzullo <[email protected]>

When the kernel is booted with ipv6.disable=1, the IPv6 module loads
but skips full initialization, leaving ipv6_stub as NULL. If the bridge
neigh_suppress feature is enabled on a port and an ICMPv6 Neighbor
Solicitation arrives, br_do_suppress_nd() calls neigh_lookup() via
ipv6_stub->nd_tbl without first checking whether ipv6_stub is valid,
causing a kernel panic.

Fix this by returning early if ipv6_stub or its nd_tbl pointer is NULL.

Reported-by: Guruprasad C P <[email protected]>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221143
Signed-off-by: Maximilian Pezzullo <[email protected]>
---
 net/bridge/br_arp_nd_proxy.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 1e2b51769eec..0b1b9ba29b7d 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -455,6 +455,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
 		return;
 	}
 
+	if (!ipv6_stub || !ipv6_stub->nd_tbl)
+		return;
+
 	n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev);
 	if (n) {
 		struct net_bridge_fdb_entry *f;

---
base-commit: af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08
change-id: 20260304-br-nd-suppress-ipv6-null-fix-0a516fc27f1a

Best regards,
-- 
Maximilian Pezzullo <[email protected]>