Eric DumazetandGreg Kroah-Hartman 1a4adfbeb4 ipv6: guard against possible NULL deref in __in6_dev_stats_get() ...

[ Upstream commit 507541c2a8 ]

dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.

Found by Sashiko.

Fixes: e1ae5c2ea4 ("vrf: Increment Icmp6InMsgs on the original netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260526145529.3587126-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-07-24 15:54:36 +02:00

..

9p

…

bluetooth

Bluetooth: serialize accept_q access

2026-06-19 13:37:26 +02:00

caif

…

iucv

…

netfilter

netfilter: nf_tables: fix set size with rbtree backend

2026-07-04 13:41:27 +02:00

netns

icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns

2026-03-04 07:20:08 -05:00

nfc

nfc: nci: Fix race between rfkill and nci_unregister_device().

2026-02-06 16:44:16 +01:00

phonet

phonet: Pass net and ifindex to phonet_address_notify().

2026-07-04 13:41:33 +02:00

sctp

sctp: detect and prevent references to a freed transport in sendmsg

2025-04-25 10:43:43 +02:00

tc_act

net/sched: fix pedit partial COW leading to page cache corruption

2026-07-04 13:41:27 +02:00

6lowpan.h

…

act_api.h

net/sched: act_api: use RCU with deferred freeing for action lifecycle

2026-06-19 13:37:08 +02:00

addrconf.h

ipv6: guard against possible NULL deref in __in6_dev_stats_get()

2026-07-24 15:54:36 +02:00

af_ieee802154.h

…

af_rxrpc.h

…

af_unix.h

af_unix: Try not to hold unix_gc_lock during accept().

2025-06-04 14:40:24 +02:00

af_vsock.h

…

ah.h

…

amt.h

…

arp.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

atmclip.h

…

ax25.h

ax25: rcu protect dev->ax25_ptr

2025-02-21 13:49:02 +01:00

ax88796.h

…

bareudp.h

…

bond_3ad.h

bonding: 3ad: implement proper RCU rules for port->aggregator

2026-06-01 17:39:30 +02:00

bond_alb.h

…

bond_options.h

bonding: add support for per-port LACP actor priority

2026-06-01 17:39:30 +02:00

bonding.h

bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded

2026-06-19 13:37:07 +02:00

bpf_sk_storage.h

…

busy_poll.h

net: busy-poll: use ktime_get_ns() instead of local_clock()

2024-09-04 13:25:02 +02:00

calipso.h

…

cfg80211-wext.h

…

cfg80211.h

cfg80211: support RNR for EMA AP

2026-01-11 15:18:59 +01:00

cfg802154.h

mac802154: fix llsec key resources release in mac802154_llsec_key_del

2024-04-03 15:19:31 +02:00

checksum.h

net: Fix checksum update for ILA adj-transport

2025-06-27 11:07:38 +01:00

cipso_ipv4.h

…

cls_cgroup.h

net/cls_cgroup: Fix task_get_classid() during qdisc run

2025-12-07 06:12:24 +09:00

codel_impl.h

…

codel_qdisc.h

…

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

devlink.h

…

dropreason.h

…

dsa.h

net: dsa: add support for mac_prepare() and mac_finish() calls

2025-05-02 07:46:50 +02:00

dsfield.h

…

dst_cache.h

…

dst_metadata.h

…

dst_ops.h

net: fix __dst_negative_advice() race

2024-06-16 13:41:40 +02:00

dst.h

net: Add locking to protect skb->dev access in ip_output

2026-01-17 16:39:28 +01:00

erspan.h

…

esp.h

…

espintcp.h

…

ethoc.h

…

failover.h

…

fib_notifier.h

…

fib_rules.h

…

firewire.h

…

flow_dissector.h

…

flow_offload.h

…

flow.h

ipv4: Drop tos parameter from flowi4_update_output()

2025-05-18 08:21:21 +02:00

fou.h

…

fq_impl.h

…

fq.h

…

garp.h

…

gen_stats.h

…

genetlink.h

genetlink: Use internal flags for multicast groups

2026-06-19 13:37:25 +02:00

geneve.h

…

gre.h

…

gro_cells.h

…

gro.h

…

gtp.h

…

gue.h

…

hwbm.h

…

icmp.h

…

ieee80211_radiotap.h

…

ieee802154_netdev.h

…

if_inet6.h

net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX

2023-12-20 17:00:15 +01:00

ife.h

…

ila.h

…

inet6_connection_sock.h

…

inet6_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_common.h

inet: factor out locked section of inet_accept() in a new helper

2024-06-12 11:03:53 +02:00

inet_connection_sock.h

tcp/dccp: allow a connection when sk_max_ack_backlog is zero

2025-01-17 13:34:38 +01:00

inet_dscp.h

…

inet_ecn.h

…

inet_frag.h

…

inet_hashtables.h

udp: Fix wildcard bind conflict check when using hash2

2026-04-11 14:16:08 +02:00

inet_sock.h

udp: fix busy polling

2024-01-31 16:17:04 -08:00

inet_timewait_sock.h

tcp/dccp: do not care about families in inet_twsk_purge()

2024-08-29 17:30:44 +02:00

inetpeer.h

inetpeer: remove create argument of inet_getpeer()

2025-02-21 13:49:01 +01:00

ioam6.h

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

2026-03-04 07:20:55 -05:00

ip6_checksum.h

…

ip6_fib.h

ipv6: Remove in6addr_any alternatives.

2023-09-19 12:28:10 +02:00

ip6_route.h

ipv6: fix source address selection with route leak

2024-08-14 13:53:02 +02:00

ip6_tunnel.h

…

ip_fib.h

ipv4: Fix incorrect TOS in route get reply

2024-08-03 08:49:24 +02:00

ip_tunnels.h

net: tunnel: make skb_vlan_inet_prepare() return drop reasons

2026-02-19 16:25:21 +01:00

ip_vs.h

ipvs: clear the svc scheduler ptr early on edit

2026-06-19 13:37:08 +02:00

ip.h

icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns

2026-03-04 07:20:08 -05:00

ipcomp.h

…

ipconfig.h

…

ipv6_frag.h

…

ipv6_stubs.h

bpf: Derive source IP addr via bpf_*_fib_lookup()

2024-03-06 14:45:20 +00:00

ipv6.h

ipv6: rename and move ip6_dst_lookup_tunnel()

2026-06-01 17:39:29 +02:00

iw_handler.h

…

kcm.h

kcm: Serialise kcm_sendmsg() for the same socket.

2024-08-29 17:30:44 +02:00

l3mdev.h

vrf: use RCU protection in l3mdev_l3_out()

2025-02-21 13:49:56 +01:00

lag.h

…

lapb.h

net: lapb: increase LAPB_HEADER_LEN

2024-12-19 18:08:53 +01:00

lib80211.h

…

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

llc: Drop support for ETH_P_TR_802_2.

2024-01-31 16:17:04 -08:00

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

…

lwtunnel.h

lwt: Check LWTUNNEL_XMIT_CONTINUE strictly

2023-09-13 09:42:33 +02:00

mac80211.h

wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

2026-06-01 17:38:40 +02:00

mac802154.h

…

macsec.h

macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads

2024-05-02 16:29:32 +02:00

mctp.h

net: mctp: fix don't require received header reserved bits to be zero

2026-06-19 13:37:20 +02:00

mctpdevice.h

…

mip6.h

…

mld.h

…

mpls_iptunnel.h

…

mpls.h

…

mptcp.h

…

mrp.h

…

ncsi.h

…

ndisc.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

neighbour.h

neighbour: add support for NUD_PERMANENT proxy entries

2025-08-28 16:25:57 +02:00

net_debug.h

…

net_failover.h

…

net_namespace.h

net: add dev_net_rcu() helper

2025-02-21 13:50:06 +01:00

net_ratelimit.h

…

net_trackers.h

…

netdev_queues.h

net: provide macros for commonly copied lockless queue stop/wake code

2024-11-01 01:56:04 +01:00

netevent.h

…

netlabel.h

…

netlink.h

netlink: allow be16 and be32 types in all uint policy checks

2026-04-11 14:16:09 +02:00

netprio_cgroup.h

…

netrom.h

…

nexthop.h

ipv6: remove nexthop_fib6_nh_bh()

2023-10-10 22:00:46 +02:00

nl802154.h

…

nsh.h

…

p8022.h

…

page_pool.h

page_pool: fix inconsistency for page_pool_ring_[un]lock()

2023-06-05 09:26:20 +02:00

pie.h

net/sched: sch_pie: annotate data-races in pie_dump_stats()

2026-06-01 17:39:25 +02:00

ping.h

net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294

2023-06-14 11:15:16 +02:00

pkt_cls.h

net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()

2026-06-01 17:38:38 +02:00

pkt_sched.h

net/sched: sch_qfq: Fix null-deref in agg_dequeue

2025-12-07 06:12:09 +09:00

pptp.h

…

protocol.h

…

psample.h

…

psnap.h

…

raw.h

…

rawv6.h

…

red.h

…

regulatory.h

wifi: cfg80211: fix regulatory disconnect with OCB/NAN

2023-07-19 16:21:10 +02:00

request_sock.h

…

rose.h

net: rose: convert 'use' field to refcount_t

2025-09-04 15:26:28 +02:00

route.h

ipv4: rename and move ip_route_output_tunnel()

2026-06-01 17:39:29 +02:00

rpl.h

ipv6: rpl: Fix Route of Death.

2023-06-14 11:15:20 +02:00

rsi_91x.h

…

rtnetlink.h

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

2026-07-24 15:54:16 +02:00

rtnh.h

…

sch_generic.h

net/sched: teql: Fix double-free in teql_master_xmit

2026-03-25 11:03:21 +01:00

scm.h

af_unix: Add dead flag to struct scm_fp_list.

2025-06-04 14:40:24 +02:00

secure_seq.h

…

seg6_hmac.h

…

seg6_local.h

…

seg6.h

…

selftests.h

…

slhc_vj.h

…

smc.h

…

snmp.h

…

sock_reuseport.h

…

sock.h

net: Drop the lock in skb_may_tx_timestamp()

2026-07-24 15:54:23 +02:00

Space.h

…

stp.h

…

strparser.h

strparser: Add read_sock callback

2025-03-07 16:56:37 +01:00

switchdev.h

net: bridge: switchdev: Skip MDB replays of deferred events on offload

2024-03-01 13:26:35 +01:00

tcp_states.h

…

tcp.h

tcp: preserve const qualifier in tcp_sk()

2026-06-01 17:39:23 +02:00

timewait_sock.h

…

tipc.h

…

tls_toe.h

…

tls.h

net: tls: Cancel RX async resync request on rcd_delta overflow

2025-12-07 06:12:39 +09:00

transp_v6.h

…

tso.h

…

tun_proto.h

…

udp_tunnel.h

ipv6: rename and move ip6_dst_lookup_tunnel()

2026-06-01 17:39:29 +02:00

udp.h

net: drop UFO packets in udp_rcv_segment()

2025-08-15 12:05:10 +02:00

udplite.h

…

vsock_addr.h

…

vxlan.h

vxlan: Fix nexthop hash size

2023-08-11 12:08:17 +02:00

wext.h

…

x25.h

…

x25device.h

…

xdp_priv.h

…

xdp_sock_drv.h

…

xdp_sock.h

xsk: Fix race condition in AF_XDP generic RX path

2026-02-19 16:25:19 +01:00

xdp.h

bpf: Clear pfmemalloc flag when freeing all fragments

2025-12-07 06:12:17 +09:00

xfrm.h

xfrm: route MIGRATE notifications to caller's netns

2026-06-19 13:37:02 +02:00

xsk_buff_pool.h

xsk: Fix race condition in AF_XDP generic RX path

2026-02-19 16:25:19 +01:00