From nobody Sat Apr 18 10:41:20 2026 Received: from out-186.mta0.migadu.com (out-186.mta0.migadu.com [91.218.175.186]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4583A2BEFE7 for ; Sat, 28 Feb 2026 03:14:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.186 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772248482; cv=none; b=cH4YjPfPfl+scD13DbAzsXDBOExQjAx5Ci+FGcmdkNAhIWFcpexkMif61K5iGkY22+KLe5KteWJWGed+39+hDmCNy41e8FVth84T3lJKSeHxPK/01134Zd9W7zI3pkAuN+aozM5/tI07kpMk9BG3BzMq/0fJc5rRTrrKCgh9760= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772248482; c=relaxed/simple; bh=D8biCTlSTEqTgNRAyZ11YJT4nk5vNVS6u9YDnBIb0Uo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=aLkjDNmU/75A6OK8lRlm/VL6qKLHOZZx/7kgDsC/nn5ok+iwHIZLtV1pLYPKJqm/NMmB4Oqy3nietccFZaeGJmudwDJKU+KLcLPOEIL7jZ1BqwkR93fElfrbM7xc4OrohdsVgUcFpMjMgEqo0IL2ETU05mQ5qXlNPM6+NbE1ix8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=VKZgd+Ux; arc=none smtp.client-ip=91.218.175.186 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="VKZgd+Ux" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1772248469; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=zTKaRJ4X6Pkk7FYFhsEZ0KaU1kgwJZU13Iz4NGl7a3c=; b=VKZgd+UxhYL4OAzWN5JvdO3rG62JTbm8LWoAe8RIYCfj+O4ZKBac5zUXYwetGGOP1wy/4P BwQVVuDDo21W0E/bdv4JExyRda+oc+jFYMcPLI3Pfx+EH4MpJUrgRmcAeOrwZcv2t9lJ2W wk7XM3BBgRutVLZVcxeUWSiC46lOOVM= From: Jiayuan Chen To: netdev@vger.kernel.org Cc: jiayuan.chen@linux.dev, Jiayuan Chen , syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com, David Ahern , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org Subject: [PATCH net v1] net: nexthop: fix panic when IPv4 route references IPv6 nexthop Date: Sat, 28 Feb 2026 11:13:59 +0800 Message-ID: <20260228031400.163009-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Jiayuan Chen fib_check_nexthop() does not validate that the nexthop family matches the route family. This allows an IPv4 route to reference an IPv6 nexthop object. When the IPv4 route is looked up, __mkroute_output() accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6 nexthops (fib6_nh_init does not call fib_nh_common_init), causing a NULL pointer dereference. Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549), which uses an AF_INET nexthop with nhc_gw_family=3DAF_INET6 and properly allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here is an AF_INET6 nexthop object being directly referenced by an IPv4 route, which is an invalid combination. Add the missing family check in fib_check_nexthop(), mirroring what fib6_check_nexthop() already does for the reverse direction (rejecting IPv6 routes that reference IPv4 nexthop objects). Reproducer: unshare -rn ip link set lo up ip nexthop add id 100 via fe80::1 dev lo ip route add 172.20.20.0/24 nhid 100 ping -c1 172.20.20.1 After fix: ... $ ip route add 172.20.20.0/24 nhid 100 Error: IPv4 routes can not use an IPv6 nexthop. Reported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@googl= e.com/T/ Fixes: 4c7e8084fd46 ("ipv4: Plumb support for nexthop object in a fib_info") Signed-off-by: Jiayuan Chen --- net/ipv4/nexthop.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 7b9d70f9b31c..0f236110cd58 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -1634,6 +1634,12 @@ int fib_check_nexthop(struct nexthop *nh, u8 scope, goto out; } =20 + if (!nhg->has_v4) { + NL_SET_ERR_MSG(extack, "IPv4 routes can not use an IPv6 nexthop"); + err =3D -EINVAL; + goto out; + } + if (scope =3D=3D RT_SCOPE_HOST) { NL_SET_ERR_MSG(extack, "Route with host scope can not have multiple nex= thops"); err =3D -EINVAL; @@ -1650,6 +1656,11 @@ int fib_check_nexthop(struct nexthop *nh, u8 scope, err =3D -EINVAL; goto out; } + if (nhi->family !=3D AF_INET) { + NL_SET_ERR_MSG(extack, "IPv4 routes can not use an IPv6 nexthop"); + err =3D -EINVAL; + goto out; + } err =3D nexthop_check_scope(nhi, scope, extack); } =20 --=20 2.43.0