[SRU][J/F][PATCH v3 0/1] CVE-2024-36901

[Vinicius Peixoto]

[Impact]
According to syzbot, there is a chance that ip6_dst_idev()
returns NULL in ip6_output(). Most places in IPv6 stack
deal with a NULL idev just fine, but not here.

[Backport]
Due to the lack of upstream commits 

5e187189ec324f78035d33a4bc123a9c4ca6f3e3 ("net: ip: add skb drop reasons for ip egress path")
d289ab65b89c1d4d88417cb6c03e923f21f95fae ("ipv6: annotate data-races around cnf.disable_ipv6") 

Jammy, Focal, Bionic and Xenial had a context conflict.
Xenial is also missing the following commits:

97a7a37a7b7bf3dd16f6fa13cfd7ffacd01a352f ("ipv6: Initial skb->dev and skb->protocol in ip6_output").
28f8bfd1ac948403ebd5c8070ae1e25421560059 ("netfilter: Support iif matches in POSTROUTING")

However, none of them directly impact the fix or the issue, so a manual
backport is appropriate here.

[Test]
Boot tested.

[Where problems could occur]
Any issues here would directly impact IPv6 networking.

[Other info]

v1 -> v2:
- Fix cover letter email subject

v2 -> v3:
- Remove unnecessary READ_ONCE annotation coming from upstream commit
  d289ab65b89c1d ("ipv6: annotate data-races around cnf.disable_ipv6")
- Add more detailed description of missing upstream commits
- Fix placement of CVE number in commit messages
- Run boot tests

Eric Dumazet (1):
  ipv6: prevent NULL dereference in ip6_output()

 net/ipv6/ip6_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.43.0