From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: netdev@vger.kernel.org, dsahern@kernel.org
Cc: jiayuan.chen@linux.dev, jiayuan.chen@shopee.com,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, Shuah Khan <shuah@kernel.org>,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org
Subject: [PATCH net v2 2/2] selftests: net: add test for IPv4 route with loopback IPv6 nexthop
Date: Mon, 2 Mar 2026 13:11:29 +0800 [thread overview]
Message-ID: <20260302051132.66314-3-jiayuan.chen@linux.dev> (raw)
In-Reply-To: <20260302051132.66314-1-jiayuan.chen@linux.dev>
From: Jiayuan Chen <jiayuan.chen@shopee.com>
Add a regression test for a panic triggered when an IPv4 route
references a loopback IPv6 nexthop object. Without the fix, this
sequence causes a NULL pointer dereference in __mkroute_output()
because nhc_pcpu_rth_output is not allocated for the nexthop.
./fib_nexthops.sh
Tests passed: 249
Tests failed: 0
Tests skipped: 2
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
---
tools/testing/selftests/net/fib_nexthops.sh | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/tools/testing/selftests/net/fib_nexthops.sh b/tools/testing/selftests/net/fib_nexthops.sh
index 21026b667667..6eb7f95e70e1 100755
--- a/tools/testing/selftests/net/fib_nexthops.sh
+++ b/tools/testing/selftests/net/fib_nexthops.sh
@@ -1672,6 +1672,17 @@ ipv4_withv6_fcnal()
run_cmd "$IP ro replace 172.16.101.1/32 via inet6 2001:db8:50::1 dev veth1"
log_test $? 2 "IPv4 route with invalid IPv6 gateway"
+
+ # Test IPv4 route with loopback IPv6 nexthop
+ # Regression test: loopback IPv6 nexthop was misclassified as reject
+ # route, skipping nhc_pcpu_rth_output allocation, causing panic when
+ # an IPv4 route references it and triggers __mkroute_output().
+ run_cmd "$IP -6 nexthop add id 20 dev lo"
+ run_cmd "$IP ro add 172.20.20.0/24 nhid 20"
+ run_cmd "ip netns exec $me ping -c1 -W1 172.20.20.1"
+ log_test $? 1 "IPv4 route with loopback IPv6 nexthop (no crash)"
+ run_cmd "$IP ro del 172.20.20.0/24"
+ run_cmd "$IP nexthop del id 20"
}
ipv4_fcnal_runtime()
--
2.43.0
next prev parent reply other threads:[~2026-03-02 5:11 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-02 5:11 [PATCH net v2 0/2] net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop and add selftest Jiayuan Chen
2026-03-02 5:11 ` [PATCH net v2 1/2] net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop Jiayuan Chen
2026-03-02 8:25 ` Ido Schimmel
2026-03-02 9:07 ` Jiayuan Chen
2026-03-02 13:38 ` Ido Schimmel
2026-03-02 5:11 ` Jiayuan Chen [this message]
2026-03-02 8:35 ` [PATCH net v2 2/2] selftests: net: add test for IPv4 route with " Ido Schimmel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260302051132.66314-3-jiayuan.chen@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jiayuan.chen@shopee.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox