Eric Dumazet 1ecc39dc8c net: prevent NULL deref in ip[6]tunnel_xmit() ...

[ Upstream commit c38b8f5f79 ]

Blamed commit missed that both functions can be called with dev == NULL.

Also add unlikely() hints for these conditions that only fuzzers can hit.

Fixes: 6f1a9140ec ("net: add xmit recursion limit to tunnel xmit functions")
Signed-off-by: Eric Dumazet <edumazet@google.com>
CC: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260312043908.2790803-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-03-25 11:08:30 +01:00

..

6lowpan

…

9p

9p/xen: protect xen_9pfs_front_free against concurrent calls

2026-03-04 07:21:22 -05:00

802

…

8021q

…

appletalk

…

atm

atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

2026-03-13 17:20:39 +01:00

ax25

…

batman-adv

…

bluetooth

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

2026-03-04 07:21:33 -05:00

bpf

bpf: Do not let BPF test infra emit invalid GSO types to stack

2026-01-30 10:28:47 +01:00

bridge

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

2026-03-13 17:20:45 +01:00

caif

…

can

can: bcm: fix locking for bcm_op runtime updates

2026-03-13 17:20:40 +01:00

ceph

libceph: define and enforce CEPH_MAX_KEY_LEN

2026-03-04 07:21:27 -05:00

core

net: add xmit recursion limit to tunnel xmit functions

2026-03-25 11:08:28 +01:00

dcb

…

dccp

…

devlink

…

dns_resolver

…

dsa

net: dsa: fix off-by-one in maximum bridge ID determination

2026-01-30 10:28:43 +01:00

ethernet

…

ethtool

…

handshake

net/handshake: restore destructor on submit failure

2026-01-08 10:14:24 +01:00

hsr

hsr: hold rcu and dev lock for hsr_get_port_ndev

2026-01-08 10:14:27 +01:00

ieee802154

…

ife

…

ipv4

net: prevent NULL deref in ip[6]tunnel_xmit()

2026-03-25 11:08:30 +01:00

ipv6

net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop

2026-03-13 17:20:46 +01:00

iucv

…

kcm

kcm: fix zero-frag skb in frag_list on partial sendmsg error

2026-03-04 07:21:33 -05:00

key

…

l2tp

l2tp: avoid one data-race in l2tp_tunnel_del_work()

2026-01-30 10:28:39 +01:00

l3mdev

…

lapb

…

llc

…

mac80211

wifi: mac80211: set default WMM parameters on all links

2026-03-25 11:08:24 +01:00

mac802154

…

mctp

mctp: route: hold key->lock in mctp_flow_prepare_output()

2026-03-25 11:08:28 +01:00

mpls

…

mptcp

mptcp: fix receive space timestamp initialization

2026-03-04 07:20:08 -05:00

ncsi

…

netfilter

netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels

2026-03-25 11:08:29 +01:00

netlabel

…

netlink

…

netrom

netrom: fix double-free in nr_route_frame()

2026-01-30 10:28:46 +01:00

nfc

nfc: rawsock: cancel tx_work before socket teardown

2026-03-13 17:20:45 +01:00

nsh

…

openvswitch

net: openvswitch: fix data race in ovs_vport_get_upcall_stats

2026-01-30 10:28:43 +01:00

packet

…

phonet

…

psample

…

qrtr

…

rds

net/rds: Fix circular locking dependency in rds_tcp_tune

2026-03-13 17:20:42 +01:00

rfkill

…

rose

net: rose: fix invalid array index in rose_kill_by_device()

2026-01-08 10:14:35 +01:00

rxrpc

rxrpc: Fix data-race warning and potential load/store tearing

2026-02-06 16:55:49 +01:00

sched

net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit

2026-03-25 11:08:27 +01:00

sctp

sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

2026-01-30 10:28:39 +01:00

smc

…

strparser

…

sunrpc

xprtrdma: Decrement re_receiving on the early exit paths

2026-03-25 11:08:26 +01:00

switchdev

…

tipc

tipc: fix RCU dereference race in tipc_aead_users_dec()

2026-03-04 07:21:53 -05:00

tls

tls: Fix race condition in tls_sw_cancel_work_tx()

2026-03-04 07:21:33 -05:00

unix

…

vmw_vsock

vmw_vsock: bypass false-positive Wnonnull warning with gcc-16

2026-03-04 07:21:18 -05:00

wireless

wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()

2026-03-13 17:20:34 +01:00

x25

…

xdp

xsk: Fix zero-copy AF_XDP fragment drop

2026-03-13 17:20:39 +01:00

xfrm

espintcp: Fix race condition in espintcp_close()

2026-03-04 07:21:31 -05:00

compat.c

…

devres.c

…

Kconfig

…

Kconfig.debug

…

Makefile

…

socket.c

net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

2026-01-11 15:25:21 +01:00

sysctl_net.c

…