diff options
| author |   Justin Iurman <justin.iurman@gmail.com> | 2026-05-17 20:30:59 +0200 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-19 18:46:44 -0700 |
| commit | d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9 (patch) | |
| tree | 135cdcc9b099d3d575a4aef1d4e5b5e42536e419 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | Merge branch 'net-phy-honor-eee_disabled_modes-when-advertising-eee' (diff) | |
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Reported by Sashiko:
The function ipv6_hop_ioam() accesses
__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned
idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr
via RCU, __in6_dev_get() can return NULL during interface teardown, which
could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop
option.
Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.
Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated Trace")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260517183059.29140-1-justin.iurman@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions