Re: [PATCH net v1] net: nexthop: fix panic when IPv4 route references IPv6 nexthop

[Jakub Kicinski <kuba@kernel.org>]

On Sat, 28 Feb 2026 11:13:59 +0800 Jiayuan Chen wrote:
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
> 
> fib_check_nexthop() does not validate that the nexthop family matches
> the route family. This allows an IPv4 route to reference an IPv6
> nexthop object. When the IPv4 route is looked up, __mkroute_output()
> accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6
> nexthops (fib6_nh_init does not call fib_nh_common_init), causing a
> NULL pointer dereference.
> 
> Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549),
> which uses an AF_INET nexthop with nhc_gw_family=AF_INET6 and properly
> allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here
> is an AF_INET6 nexthop object being directly referenced by an IPv4
> route, which is an invalid combination.
> 
> Add the missing family check in fib_check_nexthop(), mirroring what
> fib6_check_nexthop() already does for the reverse direction (rejecting
> IPv6 routes that reference IPv4 nexthop objects).

AFAICT this breaks a bunch of tests, quickest to repro with is
gre_multipath_nh.sh but you should probably run fib_nexthops.sh
on your fix as well.

> Reproducer:
> 
>   unshare -rn
>   ip link set lo up
>   ip nexthop add id 100 via fe80::1 dev lo
>   ip route add 172.20.20.0/24 nhid 100
>   ping -c1 172.20.20.1
-- 
pw-bot: cr