[PATCH] net/mpls: fix missing NULL check in mpls_valid_fib_dump_req

sunichi
2026-03-23T07:15:39Z

The attribute tb[RTA_OIF] is dereferenced without verifying if it is NULL.
If this attribute is missing in the user netlink message, it will cause a
NULL pointer dereference and kernel panic.

Add the necessary check before using the pointer to prevent the crash.

Signed-off-by: sunichi <sunyiqixm@gmail.com>
---
net/mpls/af_mpls.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index d5417688f69e..28bbea30aae3 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2174,6 +2174,8 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
int ifindex;

if (i == RTA_OIF) {
+ if (!tb[i])
+ return -EINVAL;
ifindex = nla_get_u32(tb[i]);
filter->dev = dev_get_by_index_rcu(net, ifindex);
if (!filter->dev)
--
2.34.1