On Sat, Feb 28, 2026 at 5:33 PM David Ahern [off-list ref] wrote:

On 2/28/26 8:39 AM, Jakub Kicinski wrote:

quoted

On Sat, 28 Feb 2026 11:13:59 +0800 Jiayuan Chen wrote:

quoted

From: Jiayuan Chen <redacted>

fib_check_nexthop() does not validate that the nexthop family matches
the route family. This allows an IPv4 route to reference an IPv6
nexthop object. When the IPv4 route is looked up, __mkroute_output()
accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6
nexthops (fib6_nh_init does not call fib_nh_common_init), causing a
NULL pointer dereference.

Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549),
which uses an AF_INET nexthop with nhc_gw_family=AF_INET6 and properly
allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here
is an AF_INET6 nexthop object being directly referenced by an IPv4
route, which is an invalid combination.

Add the missing family check in fib_check_nexthop(), mirroring what
fib6_check_nexthop() already does for the reverse direction (rejecting
IPv6 routes that reference IPv4 nexthop objects).

AFAICT this breaks a bunch of tests, quickest to repro with is
gre_multipath_nh.sh but you should probably run fib_nexthops.sh
on your fix as well.

nothing to fix. The patch is wrong. IPv4 supports IPv6 gateways; that is
a known feature.

please post the stack trace for the panic

https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/ (local)