Re: [PATCH net v2] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

On Thu, Aug 13, 2026 at 10:25 PM Xiang Mei <[email protected]> wrote:
>
> Hi Andrea,
>
> We noticed this is still not fixed in net.  We tested your idea and it
> works.  This is the patch we tested:
>
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 9c677eb1d1a6..51941ad656a3 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -368,23 +368,16 @@ static void seg6_update_csum(struct sk_buff *skb)
>                            (__be32 *)addr);
>  }
>
> -static int ipv6_srh_rcv(struct sk_buff *skb)
> +static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
>  {
>         struct inet6_skb_parm *opt = IP6CB(skb);
>         struct net *net = dev_net(skb->dev);
>         struct ipv6_sr_hdr *hdr;
> -       struct inet6_dev *idev;
>         struct in6_addr *addr;
>         int accept_seg6;
>
>         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
>
> -       idev = __in6_dev_get(skb->dev);
> -       if (!idev) {
> -               kfree_skb(skb);
> -               return -1;
> -       }
> -
>         accept_seg6 = min(READ_ONCE(net->ipv6.devconf_all->seg6_enabled),
>                           READ_ONCE(idev->cnf.seg6_enabled));
>
> @@ -485,12 +478,11 @@ static int ipv6_srh_rcv(struct sk_buff *skb)
>         return -1;
>  }
>
> -static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
> +static int ipv6_rpl_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
>  {
>         struct ipv6_rpl_sr_hdr *hdr, *ohdr, *chdr;
>         struct inet6_skb_parm *opt = IP6CB(skb);
>         struct net *net = dev_net(skb->dev);
> -       struct inet6_dev *idev;
>         struct ipv6hdr *oldhdr;
>         unsigned int chdr_len;
>         unsigned char *buf;
> @@ -499,8 +491,6 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
>         u64 n = 0;
>         u32 r;
>
> -       idev = __in6_dev_get(skb->dev);
> -
>         accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
>                              READ_ONCE(idev->cnf.rpl_seg_enabled));
>         if (!accept_rpl_seg) {
> @@ -689,10 +679,14 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
>         switch (hdr->type) {
>         case IPV6_SRCRT_TYPE_4:
>                 /* segment routing */
> -               return ipv6_srh_rcv(skb);
> +               if (!idev)
> +                       goto disabled;
> +               return ipv6_srh_rcv(skb, idev);
>         case IPV6_SRCRT_TYPE_3:
>                 /* rpl segment routing */
> -               return ipv6_rpl_srh_rcv(skb);
> +               if (!idev)
> +                       goto disabled;
> +               return ipv6_rpl_srh_rcv(skb, idev);
>         default:
>                 break;
>         }
> @@ -837,6 +831,10 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
>         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
>                           (&hdr->type) - skb_network_header(skb));
>         return -1;
> +
> +disabled:
> +       kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
> +       return -1;
>  }
>
>  static const struct inet6_protocol rthdr_protocol = {
>
> We don't want to take your credit, so if you have time, could you send
> this as v3?  If you don't have time to land it, we are happy to send it
> for you.
>
Sorry for my English. I mean, if you agree with this patch, you can
take it (it's based on the proposed version you mentioned).
You don't need to follow our version of imp.

Thanks,
Xiang

> Thanks,
> Xiang