syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6
route. [0]

Commit f72514b3c569 ("ipv6: clear RA flags when adding a static
route") introduced logic to clear RTF_ADDRCONF from existing routes
when a static route with the same nexthop is added. However, this
causes a problem when the existing route has a gateway.

When RTF_ADDRCONF is cleared from a route that has a gateway, that
route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns
true. The issue is that this route was never added to the
fib6_siblings list.

This leads to a mismatch between the following counts:

- The sibling count computed by iterating fib6_next chain, which
  includes the newly ECMP-eligible route

- The actual siblings in fib6_siblings list, which does not include
  that route

When a subsequent ECMP route is added, fib6_add_rt2node() hits
BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the
counts don't match.

Fix this by only clearing RTF_ADDRCONF when the existing route does
not have a gateway. Routes without a gateway cannot qualify for ECMP
anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing
RTF_ADDRCONF on them is safe and matches the original intent of the
commit.

[0]:
kernel BUG at net/ipv6/ip6_fib.c:1217!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217
[...]
Call Trace:
 <TASK>
 fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532
 __ip6_ins_rt net/ipv6/route.c:1351 [inline]
 ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946
 ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571
 inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577
 sock_do_ioctl+0xdc/0x300 net/socket.c:1245
 sock_ioctl+0x576/0x790 net/socket.c:1366
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: f72514b3c569 ("ipv6: clear RA flags when adding a static route")
Reported-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cb809def1baaac68ab92
Tested-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
---
 net/ipv6/ip6_fib.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 2111af022d94..c6439e30e892 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1138,7 +1138,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 					fib6_set_expires(iter, rt->expires);
 					fib6_add_gc_list(iter);
 				}
-				if (!(rt->fib6_flags & (RTF_ADDRCONF | RTF_PREFIX_RT))) {
+				if (!(rt->fib6_flags & (RTF_ADDRCONF | RTF_PREFIX_RT)) &&
+				    !iter->fib6_nh->fib_nh_gw_family) {
 					iter->fib6_flags &= ~RTF_ADDRCONF;
 					iter->fib6_flags &= ~RTF_PREFIX_RT;
 				}
-- 
2.52.0

On 2/4/26 10:58 AM, Shigeru Yoshida wrote:
> syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6
> route. [0]
> 
> Commit f72514b3c569 ("ipv6: clear RA flags when adding a static
> route") introduced logic to clear RTF_ADDRCONF from existing routes
> when a static route with the same nexthop is added. However, this
> causes a problem when the existing route has a gateway.
> 
> When RTF_ADDRCONF is cleared from a route that has a gateway, that
> route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns
> true. The issue is that this route was never added to the
> fib6_siblings list.
> 
> This leads to a mismatch between the following counts:
> 
> - The sibling count computed by iterating fib6_next chain, which
>    includes the newly ECMP-eligible route
> 
> - The actual siblings in fib6_siblings list, which does not include
>    that route
> 
> When a subsequent ECMP route is added, fib6_add_rt2node() hits
> BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the
> counts don't match.
> 
> Fix this by only clearing RTF_ADDRCONF when the existing route does
> not have a gateway. Routes without a gateway cannot qualify for ECMP
> anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing
> RTF_ADDRCONF on them is safe and matches the original intent of the
> commit.
> 
> [0]:
> kernel BUG at net/ipv6/ip6_fib.c:1217!
> Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
> CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217
> [...]
> Call Trace:
>   <TASK>
>   fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532
>   __ip6_ins_rt net/ipv6/route.c:1351 [inline]
>   ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946
>   ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571
>   inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577
>   sock_do_ioctl+0xdc/0x300 net/socket.c:1245
>   sock_ioctl+0x576/0x790 net/socket.c:1366
>   vfs_ioctl fs/ioctl.c:51 [inline]
>   __do_sys_ioctl fs/ioctl.c:597 [inline]
>   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>   do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fixes: f72514b3c569 ("ipv6: clear RA flags when adding a static route")
> Reported-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cb809def1baaac68ab92
> Tested-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com
> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
> ---
>   net/ipv6/ip6_fib.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)

Thanks for catching this. I got a bash reproducer and will send a 
kselftest for this specific scenario.

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>