[PATCH net v1] net: nexthop: fix panic when IPv4 route references IPv6 nexthop

[Jiayuan Chen <jiayuan.chen@linux.dev>]

From: Jiayuan Chen <jiayuan.chen@shopee.com>

fib_check_nexthop() does not validate that the nexthop family matches
the route family. This allows an IPv4 route to reference an IPv6
nexthop object. When the IPv4 route is looked up, __mkroute_output()
accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6
nexthops (fib6_nh_init does not call fib_nh_common_init), causing a
NULL pointer dereference.

Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549),
which uses an AF_INET nexthop with nhc_gw_family=AF_INET6 and properly
allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here
is an AF_INET6 nexthop object being directly referenced by an IPv4
route, which is an invalid combination.

Add the missing family check in fib_check_nexthop(), mirroring what
fib6_check_nexthop() already does for the reverse direction (rejecting
IPv6 routes that reference IPv4 nexthop objects).

Reproducer:

  unshare -rn
  ip link set lo up
  ip nexthop add id 100 via fe80::1 dev lo
  ip route add 172.20.20.0/24 nhid 100
  ping -c1 172.20.20.1

After fix:
...
$ ip route add 172.20.20.0/24 nhid 100
Error: IPv4 routes can not use an IPv6 nexthop.

Reported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/
Fixes: 4c7e8084fd46 ("ipv4: Plumb support for nexthop object in a fib_info")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
---
 net/ipv4/nexthop.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index 7b9d70f9b31c..0f236110cd58 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -1634,6 +1634,12 @@ int fib_check_nexthop(struct nexthop *nh, u8 scope,
 			goto out;
 		}
 
+		if (!nhg->has_v4) {
+			NL_SET_ERR_MSG(extack, "IPv4 routes can not use an IPv6 nexthop");
+			err = -EINVAL;
+			goto out;
+		}
+
 		if (scope == RT_SCOPE_HOST) {
 			NL_SET_ERR_MSG(extack, "Route with host scope can not have multiple nexthops");
 			err = -EINVAL;
@@ -1650,6 +1656,11 @@ int fib_check_nexthop(struct nexthop *nh, u8 scope,
 			err = -EINVAL;
 			goto out;
 		}
+		if (nhi->family != AF_INET) {
+			NL_SET_ERR_MSG(extack, "IPv4 routes can not use an IPv6 nexthop");
+			err = -EINVAL;
+			goto out;
+		}
 		err = nexthop_check_scope(nhi, scope, extack);
 	}
 
-- 
2.43.0