net: bridge: fix NULL dereference in br_do_suppress_nd when ipv6.disable=1

[PATCH] net: bridge: fix NULL dereference in br_do_suppress_nd when ipv6.disable=1

Posted by Maximilian Pezzullo via B4 Relay 1 month, 1 week ago

From: Maximilian Pezzullo <maximilianpezzullo@gmail.com>

When the kernel is booted with ipv6.disable=1, the IPv6 module loads
but skips full initialization, leaving ipv6_stub as NULL. If the bridge
neigh_suppress feature is enabled on a port and an ICMPv6 Neighbor
Solicitation arrives, br_do_suppress_nd() calls neigh_lookup() via
ipv6_stub->nd_tbl without first checking whether ipv6_stub is valid,
causing a kernel panic.

Fix this by returning early if ipv6_stub or its nd_tbl pointer is NULL.

Reported-by: Guruprasad C P <gurucp2005@bugzilla.kernel.org>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221143
Signed-off-by: Maximilian Pezzullo <maximilianpezzullo@gmail.com>
---
 net/bridge/br_arp_nd_proxy.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 1e2b51769eec..0b1b9ba29b7d 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -455,6 +455,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
 		return;
 	}
 
+	if (!ipv6_stub || !ipv6_stub->nd_tbl)
+		return;
+
 	n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev);
 	if (n) {
 		struct net_bridge_fdb_entry *f;

---
base-commit: af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08
change-id: 20260304-br-nd-suppress-ipv6-null-fix-0a516fc27f1a

Best regards,
-- 
Maximilian Pezzullo <maximilianpezzullo@gmail.com>

Re: [PATCH] net: bridge: fix NULL dereference in br_do_suppress_nd when ipv6.disable=1

Posted by Kuniyuki Iwashima 1 month, 1 week ago

From: Maximilian Pezzullo via B4 Relay <devnull+maximilianpezzullo.gmail.com@kernel.org>
Date: Wed, 04 Mar 2026 09:20:23 +0100
> From: Maximilian Pezzullo <maximilianpezzullo@gmail.com>
> 
> When the kernel is booted with ipv6.disable=1, the IPv6 module loads
> but skips full initialization, leaving ipv6_stub as NULL. If the bridge
> neigh_suppress feature is enabled on a port and an ICMPv6 Neighbor
> Solicitation arrives, br_do_suppress_nd() calls neigh_lookup() via
> ipv6_stub->nd_tbl without first checking whether ipv6_stub is valid,
> causing a kernel panic.
> 
> Fix this by returning early if ipv6_stub or its nd_tbl pointer is NULL.
> 
> Reported-by: Guruprasad C P <gurucp2005@bugzilla.kernel.org>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221143
> Signed-off-by: Maximilian Pezzullo <maximilianpezzullo@gmail.com>
> ---
>  net/bridge/br_arp_nd_proxy.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
> index 1e2b51769eec..0b1b9ba29b7d 100644
> --- a/net/bridge/br_arp_nd_proxy.c
> +++ b/net/bridge/br_arp_nd_proxy.c
> @@ -455,6 +455,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
>  		return;
>  	}
>  
> +	if (!ipv6_stub || !ipv6_stub->nd_tbl)
> +		return;

ipv6_stub is never be NULL.

Also, Fernando is already working on the fix.
https://lore.kernel.org/netdev/20260226234059.19402-1-fmancera@suse.de/
https://lore.kernel.org/netdev/20260302140847.5941-1-fmancera@suse.de/


> +
>  	n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev);
>  	if (n) {
>  		struct net_bridge_fdb_entry *f;
> 
> ---
> base-commit: af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08
> change-id: 20260304-br-nd-suppress-ipv6-null-fix-0a516fc27f1a
> 
> Best regards,
> -- 
> Maximilian Pezzullo <maximilianpezzullo@gmail.com>