[PATCH net] net/ipv4: fix NULL pointer deref in nh_valid_get_del_req()

From: Qing Luo <redacted>

rtm_del_nexthop() and nh_valid_get_bucket_req() declare their nlattr
tb arrays sized to ARRAY_SIZE(rtm_nh_policy_del) and
ARRAY_SIZE(rtm_nh_policy_get_bucket) respectively.  Both policies lack
an entry for NHA_OP_FLAGS, so the tb arrays are smaller than what
nh_valid_get_del_req() accesses via tb[NHA_OP_FLAGS].

This causes an out-of-bounds stack read.  The garbage pointer value
read from beyond the tb array is then dereferenced in nla_get_u32(),
triggering a NULL pointer dereference panic.

The bug was introduced when commit 8682b7dd4f6c ("nexthop: Fix
out-of-bounds access during attribute validation") shrank the tb
arrays from NHA_MAX+1 to ARRAY_SIZE(policy), but the policies were
not updated to include NHA_OP_FLAGS even though nh_valid_get_del_req()
already accessed that attribute.

Add [NHA_OP_FLAGS] entries to rtm_nh_policy_del and
rtm_nh_policy_get_bucket so the tb arrays are large enough.

[  647.535111] BUG: kernel NULL pointer dereference, address: 000000000000000a
[  647.542066] #PF: supervisor read access in kernel mode
[  647.547197] #PF: error_code(0x0000) - not-present page
[  647.559218] CPU: 0 PID: 42929 Comm: ip Not tainted 6.6.144 #1
[  647.579548] RIP: 0010:nh_valid_get_del_req+0x38/0xc0
[  647.998839] Kernel panic - not syncing: Fatal exception

Fixes: d8a21070b6e1 ("nexthop: Fix out-of-bounds access during attribute validation")
Signed-off-by: Qing Luo <redacted>
---
 net/ipv4/nexthop.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index 44fe75004cac..ee1d22e59c00 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c

@@ -51,6 +51,8 @@ static const struct nla_policy rtm_nh_policy_get[] = {
 
 static const struct nla_policy rtm_nh_policy_del[] = {
 	[NHA_ID]		= { .type = NLA_U32 },
+	[NHA_OP_FLAGS]		= NLA_POLICY_MASK(NLA_U32,
+						  NHA_OP_FLAGS_DUMP_ALL),
 };
 
 static const struct nla_policy rtm_nh_policy_dump[] = {

@@ -82,6 +84,8 @@ static const struct nla_policy rtm_nh_res_bucket_policy_dump[] = {
 static const struct nla_policy rtm_nh_policy_get_bucket[] = {
 	[NHA_ID]		= { .type = NLA_U32 },
 	[NHA_RES_BUCKET]	= { .type = NLA_NESTED },
+	[NHA_OP_FLAGS]		= NLA_POLICY_MASK(NLA_U32,
+						  NHA_OP_FLAGS_DUMP_ALL),
 };
 
 static const struct nla_policy rtm_nh_res_bucket_policy_get[] = {

-- 
2.25.1