Re: [PATCH net 03/10] netfilter: ip6t_rpfilter: reject routes without inet6_dev

On Thu, Sep 17, 2026 at 07:04:10PM -0700, Jakub Kicinski wrote:

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
netfilter: ip6t_rpfilter: reject routes without inet6_dev

This adds a NULL check on rt6i_idev right after the ip6_route_lookup()
call in rpfilter_lookup_reverse6(), so routes that survived in the FIB
after their nexthop device lost its inet6_dev are skipped. It protects
the later rt6i_idev->dev dereferences in the same function.

Closes: https://lore.kernel.org/all/VtWUkE8QzJt5CroTj2V2v3ZQ0gwbXZ7nq7I3@bugs.sh/ (local)

quoted

diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 67c87a88cde4f..b5def30c3127e 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c

@@ -61,7 +61,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
 		fl6.flowi6_oif = dev->ifindex;
 
 	rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
-	if (rt->dst.error)
+	if (rt->dst.error || !rt->rt6i_idev)
 		goto out;

[Severity: High]
This isn't a bug introduced by this patch, but if rt6i_idev can be NULL on
an error-free route, does the same dereference remain unguarded in
validate_ipv6_net_dev() in drivers/infiniband/core/cma.c?

drivers/infiniband/core/cma.c:validate_ipv6_net_dev() {

Not Netfilter related.