[PATCH 1/1] ipv6: Check AF_UNSPEC in ip6_route_multipath_add()

[PATCH 1/1] ipv6: Check AF_UNSPEC in ip6_route_multipath_add()

[Maksimilijan Marosevic]

This check was removed in commit e6f497955fb6 ("ipv6: Check GATEWAY
in rtm_to_fib6_multipath_config().") as part of rt6_qualify_for ecmp().
The author correctly recognises that rt6_qualify_for_ecmp() returns
false if fb_nh_gw_family is set to AF_UNSPEC, but then mistakes
AF_UNSPEC for AF_INET6 when reasoning that the check is unnecessary.
This means certain malformed entries don't get caught in
ip6_route_multipath_add().

This patch reintroduces the AF_UNSPEC check while respecting changes
of the initial patch.

Reported-by: syzbot+a259a17220263c2d73fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a259a17220263c2d73fc
Fixes: e6f497955fb6 ("ipv6: Check GATEWAY in rtm_to_fib6_multipath_config().")
Signed-off-by: Maksimilijan Marosevic <maksimilijan.marosevic@proton.me>
---
 net/ipv6/route.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3299cfa12e21..d4b988bed920 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5456,6 +5456,14 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
 			goto cleanup;
 		}
 
+		if (rt->fib6_nh->fib_nh_gw_family == AF_UNSPEC) {
+			err = -EINVAL;
+			NL_SET_ERR_MSG(extack,
+				       "Device only routes can not be added for IPv6 using the multipath API.");
+			fib6_info_release(rt);
+			goto cleanup;
+		}
+
 		rt->fib6_nh->fib_nh_weight = rtnh->rtnh_hops + 1;
 
 		err = ip6_route_info_append(&rt6_nh_list, rt, &r_cfg);
-- 
2.50.1

Re: [PATCH 1/1] ipv6: Check AF_UNSPEC in ip6_route_multipath_add()

[David Ahern]

On 8/4/25 2:42 PM, Maksimilijan Marosevic wrote:
> This check was removed in commit e6f497955fb6 ("ipv6: Check GATEWAY
> in rtm_to_fib6_multipath_config().") as part of rt6_qualify_for ecmp().
> The author correctly recognises that rt6_qualify_for_ecmp() returns
> false if fb_nh_gw_family is set to AF_UNSPEC, but then mistakes
> AF_UNSPEC for AF_INET6 when reasoning that the check is unnecessary.
> This means certain malformed entries don't get caught in
> ip6_route_multipath_add().
> 
> This patch reintroduces the AF_UNSPEC check while respecting changes
> of the initial patch.
> 
> Reported-by: syzbot+a259a17220263c2d73fc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a259a17220263c2d73fc
> Fixes: e6f497955fb6 ("ipv6: Check GATEWAY in rtm_to_fib6_multipath_config().")
> Signed-off-by: Maksimilijan Marosevic <maksimilijan.marosevic@proton.me>
> ---
>  net/ipv6/route.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 3299cfa12e21..d4b988bed920 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -5456,6 +5456,14 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
>  			goto cleanup;
>  		}
>  
> +		if (rt->fib6_nh->fib_nh_gw_family == AF_UNSPEC) {
> +			err = -EINVAL;
> +			NL_SET_ERR_MSG(extack,
> +				       "Device only routes can not be added for IPv6 using the multipath API.");
> +			fib6_info_release(rt);
> +			goto cleanup;
> +		}
> +
>  		rt->fib6_nh->fib_nh_weight = rtnh->rtnh_hops + 1;
>  
>  		err = ip6_route_info_append(&rt6_nh_list, rt, &r_cfg);

can you add another test to the routing selftests to cover this case?

Re: [PATCH 1/1] ipv6: Check AF_UNSPEC in ip6_route_multipath_add()

[Paolo Abeni]

On 8/4/25 10:42 PM, Maksimilijan Marosevic wrote:
> This check was removed in commit e6f497955fb6 ("ipv6: Check GATEWAY
> in rtm_to_fib6_multipath_config().") as part of rt6_qualify_for ecmp().
> The author correctly recognises that rt6_qualify_for_ecmp() returns
> false if fb_nh_gw_family is set to AF_UNSPEC, but then mistakes
> AF_UNSPEC for AF_INET6 when reasoning that the check is unnecessary.
> This means certain malformed entries don't get caught in
> ip6_route_multipath_add().
> 
> This patch reintroduces the AF_UNSPEC check while respecting changes
> of the initial patch.
> 
> Reported-by: syzbot+a259a17220263c2d73fc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a259a17220263c2d73fc
> Fixes: e6f497955fb6 ("ipv6: Check GATEWAY in rtm_to_fib6_multipath_config().")
> Signed-off-by: Maksimilijan Marosevic <maksimilijan.marosevic@proton.me>

Please resend in a 2 patches series including an additional self-test as
asked by David.

Also please insert into the subj prefix the target tree ('net' in this
case) and add Kuniyuki into the CC list.

Thanks,

Paolo

Re: [PATCH 1/1] ipv6: Check AF_UNSPEC in ip6_route_multipath_add()

[Jakub Kicinski]

On Mon, 04 Aug 2025 20:42:53 +0000 Maksimilijan Marosevic wrote:
> This check was removed in commit e6f497955fb6 ("ipv6: Check GATEWAY
> in rtm_to_fib6_multipath_config().") as part of rt6_qualify_for ecmp().
> The author correctly recognises that rt6_qualify_for_ecmp() returns
> false if fb_nh_gw_family is set to AF_UNSPEC, but then mistakes
> AF_UNSPEC for AF_INET6 when reasoning that the check is unnecessary.
> This means certain malformed entries don't get caught in
> ip6_route_multipath_add().
> 
> This patch reintroduces the AF_UNSPEC check while respecting changes
> of the initial patch.

Hi Maksimilijan!

Are you planning to repost this with a test?
If not I suppose we can enlist the author of the commit to help with
the selftest..

Re: [PATCH 1/1] ipv6: Check AF_UNSPEC in ip6_route_multipath_add()

[Maksimilijan Marošević]

Hi Jakub,

Sorry for the delay. 
I've managed to devise a test-case that reliably reproduces the error, but I now believe the fix can be implemented better. Unfortunately, I haven't had the chance to work on the new fix these past couple of weeks.

I'll try to finish it this weekend and then run it through syzbot once more.

Maksimilijan

-------- Original Message --------
On 04/09/2025 18:03, Jakub Kicinski <kuba@kernel.org> wrote:

>  On Mon, 04 Aug 2025 20:42:53 +0000 Maksimilijan Marosevic wrote:
>  > This check was removed in commit e6f497955fb6 ("ipv6: Check GATEWAY
>  > in rtm_to_fib6_multipath_config().") as part of rt6_qualify_for ecmp().
>  > The author correctly recognises that rt6_qualify_for_ecmp() returns
>  > false if fb_nh_gw_family is set to AF_UNSPEC, but then mistakes
>  > AF_UNSPEC for AF_INET6 when reasoning that the check is unnecessary.
>  > This means certain malformed entries don't get caught in
>  > ip6_route_multipath_add().
>  >
>  > This patch reintroduces the AF_UNSPEC check while respecting changes
>  > of the initial patch.
>  
>  Hi Maksimilijan!
>  
>  Are you planning to repost this with a test?
>  If not I suppose we can enlist the author of the commit to help with
>  the selftest..
>