Re: [PATCH net v2] ipv6: reject routes without an inet6_dev
From: Hangbin Liu
Date: Sun Nov 08 2026 - 21:02:45 EST
On Sun, Nov 08, 2026 at 03:09:36PM +0800, Yingjie Wang wrote:
> ip6_route_output() and ip6_route_lookup() can return an error-free route
> whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below
> IPV6_MIN_MTU tears down its inet6_dev, while fib6_ifdown() leaves routes
> using nexthop objects in the FIB.
>
> An unprivileged user with CAP_NET_ADMIN in a private user and network
> namespace can construct this state. Consumers which treat a route without
> an error as usable can then dereference the NULL rt6i_idev. This was
> reproduced as a KASAN NULL pointer dereference in ip6_tnl_xmit().
>
> A similar missing inet6_dev check was fixed in commit 1b9b5323725e
> ("netfilter: ip6t_rpfilter: reject routes without inet6_dev"). However,
> the route construction path still marks routes without an inet6_dev as
> successful, leaving every consumer responsible for the same check.
>
> Acquire the inet6_dev reference before initializing the destination. If a
> non-reject route has no inet6_dev, initialize it as RTN_UNREACHABLE instead
> of a successful route. Explicit reject routes keep their original type and
> error. This establishes that ordinary error-free IPv6 routes have an
> inet6_dev while retaining the existing defensive checks at callers.
>
> The modified route object builds cleanly with W=1. A full x86_64 KASAN
> bzImage build completes; it reports two pre-existing kernel-doc warnings
> outside this change.
>
> Tests:
> - `make W=1 net/ipv6/route.o`
> - full x86_64 KASAN `bzImage` build with `W=1`
> - KASAN QEMU with an unprivileged user and network namespace: after
> lowering the MTU, the stale route returned `No route to host`, a normal
> route still resolved, and the collect_md trigger completed without
> KASAN, oops, or panic
> - `tools/testing/selftests/net/ip6_tunnel.sh` in the same KASAN QEMU
>
> Fixes: 5b98324ebe29 ("ipv6: Allow routes to use nexthop objects")
> Closes: https://lore.kernel.org/netdev/tencent_CB9E1044AC97882719FF3A9F5B410A562408@xxxxxx/
> Link: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@xxxxxxxxx/
I think it should be
Closes: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@xxxxxxxxx/
The Link tag usually added by the bot when maintainer apply your patch.
> Suggested-by: Alexei Starovoitov <ast@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yingjie Wang <1075151112@xxxxxx>
> ---
> Changes since v1:
> - Move the invariant into IPv6 route construction following Alexei
> Starovoitov's review.
> - Acquire `rt6i_idev` before destination initialization and preserve the
> existing handling of explicit reject routes.
> - Update `Fixes:` to the nexthop-object route support commit.
>
> v1: https://lore.kernel.org/netdev/tencent_CB9E1044AC97882719FF3A9F5B410A562408@xxxxxx/
>
> net/ipv6/route.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 2eb884558c24..a4c792fc55e3 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1165,6 +1165,12 @@ static void ip6_rt_init_dst(struct rt6_info *rt, const struct fib6_result *res)
> return;
> }
>
> + /* addrconf_ifdown() removed inet6_dev. The device can't do IPv6. */
> + if (!rt->rt6i_idev) {
> + ip6_rt_init_dst_reject(rt, RTN_UNREACHABLE);
> + return;
> + }
> +
> rt->dst.error = 0;
> rt->dst.output = ip6_output;
>
> @@ -1200,10 +1206,10 @@ static void ip6_rt_copy_init(struct rt6_info *rt, const struct fib6_result *res)
> const struct net_device *dev = nh->fib_nh_dev;
> struct fib6_info *f6i = res->f6i;
>
> + rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
> ip6_rt_init_dst(rt, res);
>
> rt->rt6i_dst = f6i->fib6_dst;
> - rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
> rt->rt6i_flags = res->fib6_flags;
> if (nh->fib_nh_gw_family) {
> rt->rt6i_gateway = nh->fib_nh_gw6;
>
> base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
> --
> 2.43.0
>
The change looks good to me.
Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>