Eric DumazetandPaolo Abeni c38b8f5f79 net: prevent NULL deref in ip[6]tunnel_xmit() ...

Blamed commit missed that both functions can be called with dev == NULL.

Also add unlikely() hints for these conditions that only fuzzers can hit.

Fixes: 6f1a9140ec ("net: add xmit recursion limit to tunnel xmit functions")
Signed-off-by: Eric Dumazet <edumazet@google.com>
CC: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260312043908.2790803-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

2026-03-12 16:03:41 +01:00

..

9p

…

bluetooth

Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short

2026-02-23 15:28:56 -05:00

caif

…

iucv

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

libeth

libeth, idpf: use truesize as XDP RxQ info frag_size

2026-03-05 08:02:05 -08:00

mana

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

2026-02-12 17:05:20 -08:00

netfilter

netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

2026-03-05 13:22:37 +01:00

netns

vsock: lock down child_ns_mode as write-once

2026-02-26 11:10:03 +01:00

nfc

nfc: nci: Fix race between rfkill and nci_unregister_device().

2026-01-28 19:32:26 -08:00

page_pool

page_pool: store detach_time as ktime_t to avoid false-negatives

2026-03-10 19:03:34 -07:00

phonet

…

phy

net: phy: realtek: add dummy PHY driver for RTL8127ATF

2026-01-12 19:29:11 -08:00

psp

…

sctp

…

tc_act

net/sched: act_ife: Fix metalist update behavior

2026-03-05 07:54:08 -08:00

6lowpan.h

…

act_api.h

net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

2026-02-27 19:06:21 -08:00

addrconf.h

ipv6: addrconf: reduce default temp_valid_lft to 2 days

2026-02-17 17:12:06 -08:00

af_ieee802154.h

…

af_rxrpc.h

…

af_unix.h

…

af_vsock.h

vsock: lock down child_ns_mode as write-once

2026-02-26 11:10:03 +01:00

ah.h

…

aligned_data.h

…

amt.h

…

arp.h

…

atmclip.h

…

ax25.h

Merge tag 'sysctl-7.00-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl

2026-02-18 10:45:36 -08:00

ax88796.h

…

bareudp.h

…

bond_3ad.h

…

bond_alb.h

…

bond_options.h

…

bonding.h

bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded

2026-03-03 10:47:37 +01:00

bpf_sk_storage.h

…

busy_poll.h

…

calipso.h

…

can.h

can: add CAN skb extension infrastructure

2026-02-05 11:58:39 +01:00

cfg80211-wext.h

…

cfg80211.h

wifi: cfg80211: add initial UHR support

2026-02-02 10:11:07 +01:00

cfg802154.h

…

checksum.h

…

cipso_ipv4.h

…

cls_cgroup.h

…

codel_impl.h

…

codel_qdisc.h

…

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

devlink.h

…

dropreason-core.h

net: add net.core.qdisc_max_burst

2026-01-13 10:12:11 +01:00

dropreason.h

…

dsa_stubs.h

…

dsa.h

net: dsa: add tag format for MxL862xx switches

2026-02-11 11:27:57 +01:00

dscp.h

…

dsfield.h

…

dst_cache.h

…

dst_metadata.h

…

dst_ops.h

…

dst.h

inet: add dst4_mtu() and dst6_mtu() helpers

2026-02-02 17:49:29 -08:00

eee.h

…

erspan.h

…

esp.h

…

espintcp.h

…

ethoc.h

…

failover.h

…

fib_notifier.h

…

fib_rules.h

…

firewire.h

…

flow_dissector.h

…

flow_offload.h

net: dsa: eliminate local type for tc policers

2026-02-10 15:30:11 +01:00

flow.h

…

fou.h

…

fq_impl.h

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fq.h

…

garp.h

…

gen_stats.h

…

genetlink.h

…

geneve.h

…

gre.h

…

gro_cells.h

…

gro.h

gro: inline tcp6_gro_complete()

2026-01-21 19:28:32 -08:00

gso.h

…

gtp.h

…

gue.h

…

handshake.h

…

hotdata.h

net: add net.core.qdisc_max_burst

2026-01-13 10:12:11 +01:00

hwbm.h

…

icmp.h

…

ieee8021q.h

…

ieee80211_radiotap.h

…

ieee802154_netdev.h

…

if_inet6.h

…

ife.h

…

inet6_connection_sock.h

tcp: populate inet->cork.fl.u.ip6 in tcp_v6_syn_recv_sock()

2026-02-10 20:57:50 -08:00

inet6_hashtables.h

inet: annotate data-races around isk->inet_num

2026-02-27 17:16:59 -08:00

inet_common.h

…

inet_connection_sock.h

tcp: fix potential race in tcp_v6_syn_recv_sock()

2026-02-19 14:02:19 -08:00

inet_dscp.h

…

inet_ecn.h

tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers

2026-02-03 15:13:24 +01:00

inet_frag.h

inet: frags: flush pending skbs in fqdir_pre_exit()

2025-12-10 01:15:27 -08:00

inet_hashtables.h

inet: annotate data-races around isk->inet_num

2026-02-27 17:16:59 -08:00

inet_sock.h

ipv6: colocate inet6_cork in inet_cork_full

2026-02-02 17:49:30 -08:00

inet_timewait_sock.h

…

inetpeer.h

…

ioam6.h

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

2026-02-13 12:24:05 -08:00

ip6_checksum.h

…

ip6_fib.h

…

ip6_route.h

inet: add dst4_mtu() and dst6_mtu() helpers

2026-02-02 17:49:29 -08:00

ip6_tunnel.h

net: prevent NULL deref in ip[6]tunnel_xmit()

2026-03-12 16:03:41 +01:00

ip_fib.h

net: ipv4: fix ARM64 alignment fault in multipath hash seed

2026-03-03 17:20:37 -08:00

ip_tunnels.h

net: add xmit recursion limit to tunnel xmit functions

2026-03-10 13:30:30 +01:00

ip_vs.h

…

ip.h

inet: annotate data-races around isk->inet_num

2026-02-27 17:16:59 -08:00

ipcomp.h

…

ipconfig.h

…

ipv6_frag.h

inet: frags: flush pending skbs in fqdir_pre_exit()

2025-12-10 01:15:27 -08:00

ipv6_stubs.h

…

ipv6.h

ipv6: fix a race in ip6_sock_set_v6only()

2026-02-17 16:45:29 -08:00

iw_handler.h

…

kcm.h

…

l3mdev.h

net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()

2026-02-02 17:09:11 -08:00

lag.h

…

lapb.h

…

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

…

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

…

lwtunnel.h

…

mac80211.h

wifi: mac80211: Add eMLSR/eMLMR action frame parsing support

2026-02-02 10:11:18 +01:00

mac802154.h

…

macsec.h

…

mctp.h

…

mctpdevice.h

…

mip6.h

…

mld.h

…

mpls_iptunnel.h

…

mpls.h

…

mptcp.h

…

mrp.h

…

ncsi.h

…

ndisc.h

…

neighbour_tables.h

…

neighbour.h

…

net_debug.h

…

net_failover.h

…

net_namespace.h

netns: optimize netns cleaning by batching unhash_nsid calls

2026-02-06 20:01:31 -08:00

net_ratelimit.h

…

net_shaper.h

…

net_trackers.h

…

netdev_lock.h

…

netdev_netlink.h

…

netdev_queues.h

net: add queue config validation callback

2026-01-23 11:49:02 -08:00

netdev_rx_queue.h

Revert "Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp'"

2026-01-20 18:06:01 -08:00

netevent.h

…

netkit.h

…

netlabel.h

…

netlink.h

…

netmem.h

net: inline get_netmem() and put_netmem()

2026-01-25 13:18:53 -08:00

netprio_cgroup.h

…

netrom.h

…

nexthop.h

…

nl802154.h

…

nsh.h

…

pfcp.h

…

pie.h

…

ping.h

…

pkt_cls.h

…

pkt_sched.h

net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue

2026-02-05 09:32:45 -08:00

pptp.h

…

proto_memory.h

…

protocol.h

…

psample.h

…

psnap.h

…

psp.h

…

raw.h

…

rawv6.h

…

red.h

…

regulatory.h

…

request_sock.h

tcp: move __reqsk_free() out of line

2026-02-05 09:23:06 -08:00

rose.h

…

route.h

…

rpl.h

…

rps.h

…

rsi_91x.h

…

rstreason.h

…

rtnetlink.h

…

rtnh.h

…

sch_generic.h

net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs

2026-03-04 17:43:45 -08:00

sch_priv.h

net/sched: Export mq functions for reuse

2026-01-13 11:54:29 +01:00

scm.h

…

secure_seq.h

tcp: secure_seq: add back ports to TS offset

2026-03-04 17:44:35 -08:00

seg6_hmac.h

…

seg6_local.h

…

seg6.h

…

selftests.h

…

slhc_vj.h

…

smc.h

…

snmp.h

…

sock_reuseport.h

…

sock.h

net: Drop the lock in skb_may_tx_timestamp()

2026-02-24 11:27:29 +01:00

Space.h

…

stp.h

…

strparser.h

…

switchdev.h

…

tc_wrapper.h

…

tcp_ao.h

…

tcp_ecn.h

tcp: accecn: add tcpi_ecn_mode and tcpi_option2 in tcp_info

2026-02-03 15:13:25 +01:00

tcp_states.h

…

tcp.h

tcp: secure_seq: add back ports to TS offset

2026-03-04 17:44:35 -08:00

tcx.h

…

timewait_sock.h

…

tipc.h

…

tls_prot.h

…

tls_toe.h

…

tls.h

…

transp_v6.h

…

tso.h

…

tun_proto.h

…

udp_tunnel.h

geneve: expose gso partial features for tunnel offload

2026-01-23 11:31:14 -08:00

udp.h

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

udplite.h

…

vsock_addr.h

…

vxlan.h

…

wext.h

…

x25.h

…

x25device.h

…

xdp_priv.h

…

xdp_sock_drv.h

xsk: introduce helper to determine rxq->frag_size

2026-03-05 08:02:03 -08:00

xdp_sock.h

…

xdp.h

…

xfrm.h

xfrm: reduce struct sec_path size

2026-02-10 20:21:48 -08:00

xsk_buff_pool.h

xsk: move cq_cached_prod_lock to avoid touching a cacheline in sending path

2026-01-15 10:07:45 +01:00