On 3/9/24 8:02 AM, Eric Dumazet wrote:

...

quoted

-
 /* rtnl */
 static int rtm_del_nexthop(struct sk_buff *skb, struct nlmsghdr *nlh,
                           struct netlink_ext_ack *extack)
 {
        struct net *net = sock_net(skb->sk);
+       struct nlattr *tb[NHA_MAX + 1];

big tb[] array, but small rtm_nh_policy_del[] policy.

quoted

        struct nl_info nlinfo = {
                .nlh = nlh,
                .nl_net = net,

@@ -3020,7 +3010,12 @@ static int rtm_del_nexthop(struct sk_buff *skb, struct nlmsghdr *nlh,
        int err;
        u32 id;

-       err = nh_valid_get_del_req(nlh, &id, extack);
+       err = nlmsg_parse(nlh, sizeof(struct nhmsg), tb, NHA_MAX,

But here you pass NHA_MAX...

existing code always used ARRAY_SIZE on the policy for both tb and
parse; the new del change should use it. Missed that in the review.