Re: [PATCH net 03/10] netfilter: ip6t_rpfilter: reject routes without inet6_dev

On Thu, Sep 17, 2026 at 07:04:10PM -0700, Jakub Kicinski wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> netfilter: ip6t_rpfilter: reject routes without inet6_dev
> 
> This adds a NULL check on rt6i_idev right after the ip6_route_lookup()
> call in rpfilter_lookup_reverse6(), so routes that survived in the FIB
> after their nexthop device lost its inet6_dev are skipped. It protects
> the later rt6i_idev->dev dereferences in the same function.
> 
> Closes: https://lore.kernel.org/all/[email protected]/
> 
> > diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
> > index 67c87a88cde4f..b5def30c3127e 100644
> > --- a/net/ipv6/netfilter/ip6t_rpfilter.c
> > +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
> > @@ -61,7 +61,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
> >  		fl6.flowi6_oif = dev->ifindex;
> >  
> >  	rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
> > -	if (rt->dst.error)
> > +	if (rt->dst.error || !rt->rt6i_idev)
> >  		goto out;
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but if rt6i_idev can be NULL on
> an error-free route, does the same dereference remain unguarded in
> validate_ipv6_net_dev() in drivers/infiniband/core/cma.c?
> 
> drivers/infiniband/core/cma.c:validate_ipv6_net_dev() {

Not Netfilter related.