On 6/17/26 2:55 PM, Weiming Shi wrote:

accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)
and dereferences idev->cnf.accept_untracked_na without a NULL check,
even though its only caller ndisc_recv_na() already fetched and
NULL-checked idev for the same device.

Both reads of dev->ip6_ptr run in the same RCU read-side critical
section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr
between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()
without the synchronize_net() that orders the unregister path, so the
re-fetch returns NULL and oopses:

  BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)
  Read of size 4 at addr 0000000000000364
  Call Trace:
   <IRQ>
   ndisc_recv_na (net/ipv6/ndisc.c:974)
   icmpv6_rcv (net/ipv6/icmp.c:1193)
   ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)
   ip6_input_finish (net/ipv6/ip6_input.c:534)
   ip6_input (net/ipv6/ip6_input.c:545)
   ip6_mc_input (net/ipv6/ip6_input.c:635)
   ipv6_rcv (net/ipv6/ip6_input.c:351)
   </IRQ>

It is reachable by an unprivileged user via a network namespace.

Pass the caller's already validated idev instead of re-fetching it; the
idev stays alive for the whole RCU critical section, so it is safe even
after dev->ip6_ptr has been cleared.

Fixes: aaa5f515b16b ("net: ipv6: new accept_untracked_na option to accept na only if in-network")
Assisted-by: Claude:claude-opus-4-8
Reported-by: Xiang Mei <redacted>
Signed-off-by: Weiming Shi <redacted>

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>