From: Maximilian Pezzullo <[email protected]> When the kernel is booted with ipv6.disable=1, the IPv6 module loads but skips full initialization, leaving ipv6_stub as NULL. If the bridge neigh_suppress feature is enabled on a port and an ICMPv6 Neighbor Solicitation arrives, br_do_suppress_nd() calls neigh_lookup() via ipv6_stub->nd_tbl without first checking whether ipv6_stub is valid, causing a kernel panic.
Fix this by returning early if ipv6_stub or its nd_tbl pointer is NULL. Reported-by: Guruprasad C P <[email protected]> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221143 Signed-off-by: Maximilian Pezzullo <[email protected]> --- net/bridge/br_arp_nd_proxy.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c index 1e2b51769eec..0b1b9ba29b7d 100644 --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -455,6 +455,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, return; } + if (!ipv6_stub || !ipv6_stub->nd_tbl) + return; + n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev); if (n) { struct net_bridge_fdb_entry *f; --- base-commit: af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08 change-id: 20260304-br-nd-suppress-ipv6-null-fix-0a516fc27f1a Best regards, -- Maximilian Pezzullo <[email protected]>
