From nobody Sat Jul 25 20:48:49 2026 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05A7735AC03 for ; Mon, 13 Jul 2026 22:15:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783980955; cv=none; b=D2jACyXtP0yE4XDEJ9MLQCHjpPHVZkLes2d8fLlY/dS8f+QwXoETpSyABEUm9VlUg8xOc8ly2N1GHCZEqL9vQogm9ytwas2hYE178AQ/lU554kjNqUY5sm/TFantXetBL9/pvc96JZtMo49Zwlmr3d6YosCijY6QftYtIkwnwdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783980955; c=relaxed/simple; bh=W50T5GS5RhtgQrX1rqdT/yM+AtlTrx/Uz9g0NTLB27s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iVPd+nOvZkwO2tZHDpolKjLrNKakzxiX+yba2JbNtBf0KiDg4hmpAJkUvHyziGjD1hhwCrHKb7fv+rmaNWPAFp/Suh+oqAEjTb6ZPEWvcuCHvAlD+wL7bbPuhOnXtQ5GVEJJ8XQhmD4LPP903HIqI6yjWZNH7EKJnDOMbF/c+s0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=rFnHVpNR; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="rFnHVpNR" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-381891a9525so4048123a91.3 for ; Mon, 13 Jul 2026 15:15:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783980953; x=1784585753; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=tbraxpj7kQUhZfQBAZU6pBiadDbmkj02vD6BfbHFaKo=; b=rFnHVpNRqadlUud7f9mk1Khk2chPvKHczX4WbJj5pVBA54fJhmCQng9yBOFc7KzeEn Oq6Bp+5gh8rSsIL07EcHSm1hRyZhv4GvNlp34x+HD2Q30DcVGbhNGE5HK36+dpqVrQTQ EbCtiqOeL1C/qIQTMpTJ5XKqUYYmGSP39tUI29EnJRhG+RqN1DZVuCyjWRUZ+wMj3FQ2 MXy1xxrodxHaNKo716/S/c0VY3PJ9XtY/KbNjrlhP4Kq9kW9PgKOorcUkbm3yuLxHH4c Ht2AezJMwOiRi5rRMhDmX/ePC2t2IjCT5XXQXsN1ZvPShk1cNtEKDSYDyuOq8hFWcUIW gK4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783980953; x=1784585753; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tbraxpj7kQUhZfQBAZU6pBiadDbmkj02vD6BfbHFaKo=; b=OYoGAyjjqKdO7bGsQkbGKGEuh4uciPzIiDmM8gNYoqm6onawqMZJ97dTTzRpSnmUGL HI/z0+Uze23TK7WB9LRu6er3YAkQSDUeyKR8wRrB5e1VRJrWtpnk1roxEgXNKyvGXcVC 1ZLzdX+c1VJEBT9rn5Z64YYQZdEk0wqqDnVh8qlmu9hU51MhRgzKSQeo6axX1GbSj02Z ERFqZ7YLDSqIPt65EKq21Ukbp12uu7PjYAkT8SWa7iGRSqa6gnTtVdv390K/UHTvhQDx 53ACY1nVjnmFT+6DbnA6vndvaqX62eagKCzuE3IFdz6GwJBpfJ791sX+BYWL3PymWgtl 2afg== X-Forwarded-Encrypted: i=1; AHgh+RpfpQDGRGcVhQxZjfMEqUcc5ghzOTDwNY5VHTnCnFExY2FYGGr6FrQeRrH9VTPYkmppIyfpYONIIbw9nW0=@vger.kernel.org X-Gm-Message-State: AOJu0YzLZcgjjSroUsUkr43+RbkAzFPNjV9G3KYrGTR2ndJg9eL84o// DMh40BvQVAhhfWdwwa7YylU5lBBxaq3N1buV/bkNyAAg2AzFDlYSL/2QENaj02v5bN6FcKAgRvO EE4o= X-Gm-Gg: AfdE7clCnWdA1PgQGimaGqsqzFEkSFvF7jmnotYSnN8VurgzJb/QXFCbuqO6RFB5wKE U/m9y9e9o9azVosmVDasDhPLIYyvf60Y6vEnm5j8NSOqr9x0JttPfRdSdxvVMfeg0HMT1jvf/cQ CCpZ2K7TDF1wu8IdQ0DTcSyfdVa8rBYPZqSiEIFz/DSPt43eoJL2/tiAanQhrxruz1nWW+AieTw C8xsogFlkO3Z+5oO0NQTfMK6izODcdOiAs3J5CcwtfQj5c/C+FTq/H2g6KzQmU9Xtu317e/nUz3 YllkTZrJoGPsYfJc5qQC/qZN4i6uU/pkUGylgoa2s+WEJth621b6wwaY3VSXJBTHvCdXlNOyh2e iNh6c2Dv9caebSCWL/LAA0WvnCUSDfytMTRi40lVMppZzeTLNdNPg+GUXG2A7llDx5GXCWh7ygG Fz5+Qr1WDoqoDMYX3z2g== X-Received: by 2002:a17:90b:3c10:b0:381:cef1:11bb with SMTP id 98e67ed59e1d1-38dc774d03fmr10598405a91.22.1783980953360; Mon, 13 Jul 2026 15:15:53 -0700 (PDT) Received: from xiang.tailc0aff1.ts.net ([20.171.14.70]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3117483dec6sm75300590eec.11.2026.07.13.15.15.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 15:15:53 -0700 (PDT) From: "Xiang Mei (Microsoft)" To: David Ahern , Ido Schimmel Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Petr Machata , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, "Xiang Mei (Microsoft)" Subject: [PATCH net] nexthop: initialize extack in nh_res_bucket_migrate() Date: Mon, 13 Jul 2026 22:15:51 +0000 Message-ID: <20260713221551.3344650-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns -ENOMEM), the error is propagated back before any notifier sets extack._msg, and the error path formats the stale pointer with pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE this dereferences uninitialized stack memory: Oops: general protection fault, probably for non-canonical address ... KASAN: maybe wild-memory-access in range [...] RIP: 0010:string (lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) _printk (kernel/printk/printk.c:2504) nh_res_bucket_migrate (net/ipv4/nexthop.c:1816) nh_res_table_upkeep (net/ipv4/nexthop.c:1866) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) netlink_sendmsg (net/netlink/af_netlink.c:1900) Kernel panic - not syncing: Fatal exception Zero-initialize extack so _msg is NULL on error paths that never set it. Fixes: 7c37c7e00411 ("nexthop: Implement notifiers for resilient nexthop gr= oups") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Xiang Mei (Microsoft) Reviewed-by: Ido Schimmel --- net/ipv4/nexthop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 6205bd57aa85..44fe75004cac 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -1788,8 +1788,8 @@ static bool nh_res_bucket_migrate(struct nh_res_table= *res_table, bool notify_nl, bool force) { struct nh_res_bucket *bucket =3D &res_table->nh_buckets[bucket_index]; + struct netlink_ext_ack extack =3D {}; struct nh_grp_entry *new_nhge; - struct netlink_ext_ack extack; int err; =20 new_nhge =3D list_first_entry_or_null(&res_table->uw_nh_entries, --=20 2.43.0