Re: [PATCH net] net/ipv4: fix NULL pointer deref in nh_valid_get_del_req()

On Mon, Jul 27, 2026 at 10:26:19AM +0800, luoqing wrote:

From: Qing Luo <redacted>

rtm_del_nexthop() and nh_valid_get_bucket_req() declare their nlattr
tb arrays sized to ARRAY_SIZE(rtm_nh_policy_del) and
ARRAY_SIZE(rtm_nh_policy_get_bucket) respectively.  Both policies lack
an entry for NHA_OP_FLAGS, so the tb arrays are smaller than what
nh_valid_get_del_req() accesses via tb[NHA_OP_FLAGS].

But nh_valid_get_del_req() only accesses tb[NHA_OP_FLAGS] when
'op_flags' is not NULL and both rtm_del_nexthop() and
nh_valid_get_bucket_req() pass NULL, so I don't see how this bug can
happen?

This causes an out-of-bounds stack read.  The garbage pointer value
read from beyond the tb array is then dereferenced in nla_get_u32(),
triggering a NULL pointer dereference panic.

The bug was introduced when commit 8682b7dd4f6c ("nexthop: Fix

This hash doesn't exist and it differs from the one below.

out-of-bounds access during attribute validation") shrank the tb
arrays from NHA_MAX+1 to ARRAY_SIZE(policy), but the policies were
not updated to include NHA_OP_FLAGS even though nh_valid_get_del_req()
already accessed that attribute.

Add [NHA_OP_FLAGS] entries to rtm_nh_policy_del and
rtm_nh_policy_get_bucket so the tb arrays are large enough.

[  647.535111] BUG: kernel NULL pointer dereference, address: 000000000000000a
[  647.542066] #PF: supervisor read access in kernel mode
[  647.547197] #PF: error_code(0x0000) - not-present page
[  647.559218] CPU: 0 PID: 42929 Comm: ip Not tainted 6.6.144 #1

6.6.144 doesn't even support NHA_OP_FLAGS and doesn't have
rtm_nh_policy_del. Can you reproduce the bug with net.git?

[  647.579548] RIP: 0010:nh_valid_get_del_req+0x38/0xc0
[  647.998839] Kernel panic - not syncing: Fatal exception

Fixes: d8a21070b6e1 ("nexthop: Fix out-of-bounds access during attribute validation")
Signed-off-by: Qing Luo <redacted>