[PATCH net] net/ipv4: fix NULL pointer deref in nh_valid_get_del_req()

[PATCH net] net/ipv4: fix NULL pointer deref in nh_valid_get_del_req()

[luoqing]

From: Qing Luo <luoqing@kylinos.cn>

rtm_del_nexthop() and nh_valid_get_bucket_req() declare their nlattr
tb arrays sized to ARRAY_SIZE(rtm_nh_policy_del) and
ARRAY_SIZE(rtm_nh_policy_get_bucket) respectively.  Both policies lack
an entry for NHA_OP_FLAGS, so the tb arrays are smaller than what
nh_valid_get_del_req() accesses via tb[NHA_OP_FLAGS].

This causes an out-of-bounds stack read.  The garbage pointer value
read from beyond the tb array is then dereferenced in nla_get_u32(),
triggering a NULL pointer dereference panic.

The bug was introduced when commit 8682b7dd4f6c ("nexthop: Fix
out-of-bounds access during attribute validation") shrank the tb
arrays from NHA_MAX+1 to ARRAY_SIZE(policy), but the policies were
not updated to include NHA_OP_FLAGS even though nh_valid_get_del_req()
already accessed that attribute.

Add [NHA_OP_FLAGS] entries to rtm_nh_policy_del and
rtm_nh_policy_get_bucket so the tb arrays are large enough.

[  647.535111] BUG: kernel NULL pointer dereference, address: 000000000000000a
[  647.542066] #PF: supervisor read access in kernel mode
[  647.547197] #PF: error_code(0x0000) - not-present page
[  647.559218] CPU: 0 PID: 42929 Comm: ip Not tainted 6.6.144 #1
[  647.579548] RIP: 0010:nh_valid_get_del_req+0x38/0xc0
[  647.998839] Kernel panic - not syncing: Fatal exception

Fixes: d8a21070b6e1 ("nexthop: Fix out-of-bounds access during attribute validation")
Signed-off-by: Qing Luo <luoqing@kylinos.cn>
---
 net/ipv4/nexthop.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index 44fe75004cac..ee1d22e59c00 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -51,6 +51,8 @@ static const struct nla_policy rtm_nh_policy_get[] = {
 
 static const struct nla_policy rtm_nh_policy_del[] = {
 	[NHA_ID]		= { .type = NLA_U32 },
+	[NHA_OP_FLAGS]		= NLA_POLICY_MASK(NLA_U32,
+						  NHA_OP_FLAGS_DUMP_ALL),
 };
 
 static const struct nla_policy rtm_nh_policy_dump[] = {
@@ -82,6 +84,8 @@ static const struct nla_policy rtm_nh_res_bucket_policy_dump[] = {
 static const struct nla_policy rtm_nh_policy_get_bucket[] = {
 	[NHA_ID]		= { .type = NLA_U32 },
 	[NHA_RES_BUCKET]	= { .type = NLA_NESTED },
+	[NHA_OP_FLAGS]		= NLA_POLICY_MASK(NLA_U32,
+						  NHA_OP_FLAGS_DUMP_ALL),
 };
 
 static const struct nla_policy rtm_nh_res_bucket_policy_get[] = {
-- 
2.25.1

Re: [PATCH net] net/ipv4: fix NULL pointer deref in nh_valid_get_del_req()

[Ido Schimmel]

On Mon, Jul 27, 2026 at 10:26:19AM +0800, luoqing wrote:
> From: Qing Luo <luoqing@kylinos.cn>
> 
> rtm_del_nexthop() and nh_valid_get_bucket_req() declare their nlattr
> tb arrays sized to ARRAY_SIZE(rtm_nh_policy_del) and
> ARRAY_SIZE(rtm_nh_policy_get_bucket) respectively.  Both policies lack
> an entry for NHA_OP_FLAGS, so the tb arrays are smaller than what
> nh_valid_get_del_req() accesses via tb[NHA_OP_FLAGS].

But nh_valid_get_del_req() only accesses tb[NHA_OP_FLAGS] when
'op_flags' is not NULL and both rtm_del_nexthop() and
nh_valid_get_bucket_req() pass NULL, so I don't see how this bug can
happen?

> 
> This causes an out-of-bounds stack read.  The garbage pointer value
> read from beyond the tb array is then dereferenced in nla_get_u32(),
> triggering a NULL pointer dereference panic.
> 
> The bug was introduced when commit 8682b7dd4f6c ("nexthop: Fix

This hash doesn't exist and it differs from the one below.

> out-of-bounds access during attribute validation") shrank the tb
> arrays from NHA_MAX+1 to ARRAY_SIZE(policy), but the policies were
> not updated to include NHA_OP_FLAGS even though nh_valid_get_del_req()
> already accessed that attribute.
> 
> Add [NHA_OP_FLAGS] entries to rtm_nh_policy_del and
> rtm_nh_policy_get_bucket so the tb arrays are large enough.
> 
> [  647.535111] BUG: kernel NULL pointer dereference, address: 000000000000000a
> [  647.542066] #PF: supervisor read access in kernel mode
> [  647.547197] #PF: error_code(0x0000) - not-present page
> [  647.559218] CPU: 0 PID: 42929 Comm: ip Not tainted 6.6.144 #1

6.6.144 doesn't even support NHA_OP_FLAGS and doesn't have
rtm_nh_policy_del. Can you reproduce the bug with net.git?

> [  647.579548] RIP: 0010:nh_valid_get_del_req+0x38/0xc0
> [  647.998839] Kernel panic - not syncing: Fatal exception
> 
> Fixes: d8a21070b6e1 ("nexthop: Fix out-of-bounds access during attribute validation")
> Signed-off-by: Qing Luo <luoqing@kylinos.cn>