[Devel] [PATCH hci-8.1] net/ip6_gre: fix a host panic adding ip6gre in a CT without ipgre

[Konstantin Khorenko]

Applying as is.

On Wed, 4 Nov 2026 21:07:55 +0100, Denis V. Lunev wrote:
> -	ip6gre_netlink_parms(data, &nt->parms);
>  	ign = net_generic(net, ip6gre_net_id);
> +#ifdef CONFIG_VE
> +	if (!ign) /* no VE_FEATURE_IPGRE */
> +		return -EACCES;
> +#endif

- Please send a separate patch for ip6gre_dellink(), it has the same
  NULL ign. I have already created a task for it:
  https://virtuozzo.atlassian.net/browse/VSTOR-153615

ip6gre_dellink() takes ign from dev_net(dev), not from t->net as
changelink, uninit and the ioctl path do. Only the fallback device is
netns_immutable, and moving a device into another netns does not check
VE_FEATURE_IPGRE. So the host can do

    ip link add t6 type ip6gre local A remote B
    ip link set t6 netns <CT without ipgre>

and then "ip link del t6" in the CT, or just stopping the CT, reads
ign->fb_tunnel_dev through a NULL ign and oopses the node. Only kind
ip6gre has ->dellink, ip6gretap and ip6erspan are fine.

Taking ign from t->net there is enough, mainline did the same in
b7c0d393e108a ("ip6_gre: Unlink ip6gre_tunnel_unlink() from
->dellink().").

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team