Re: [PATCH net] net/ipv4: fix NULL pointer deref in nh_valid_get_del_req()

[Ido Schimmel <idosch@nvidia.com>]

On Mon, Jul 27, 2026 at 10:26:19AM +0800, luoqing wrote:
> From: Qing Luo <luoqing@kylinos.cn>
> 
> rtm_del_nexthop() and nh_valid_get_bucket_req() declare their nlattr
> tb arrays sized to ARRAY_SIZE(rtm_nh_policy_del) and
> ARRAY_SIZE(rtm_nh_policy_get_bucket) respectively.  Both policies lack
> an entry for NHA_OP_FLAGS, so the tb arrays are smaller than what
> nh_valid_get_del_req() accesses via tb[NHA_OP_FLAGS].

But nh_valid_get_del_req() only accesses tb[NHA_OP_FLAGS] when
'op_flags' is not NULL and both rtm_del_nexthop() and
nh_valid_get_bucket_req() pass NULL, so I don't see how this bug can
happen?

> 
> This causes an out-of-bounds stack read.  The garbage pointer value
> read from beyond the tb array is then dereferenced in nla_get_u32(),
> triggering a NULL pointer dereference panic.
> 
> The bug was introduced when commit 8682b7dd4f6c ("nexthop: Fix

This hash doesn't exist and it differs from the one below.

> out-of-bounds access during attribute validation") shrank the tb
> arrays from NHA_MAX+1 to ARRAY_SIZE(policy), but the policies were
> not updated to include NHA_OP_FLAGS even though nh_valid_get_del_req()
> already accessed that attribute.
> 
> Add [NHA_OP_FLAGS] entries to rtm_nh_policy_del and
> rtm_nh_policy_get_bucket so the tb arrays are large enough.
> 
> [  647.535111] BUG: kernel NULL pointer dereference, address: 000000000000000a
> [  647.542066] #PF: supervisor read access in kernel mode
> [  647.547197] #PF: error_code(0x0000) - not-present page
> [  647.559218] CPU: 0 PID: 42929 Comm: ip Not tainted 6.6.144 #1

6.6.144 doesn't even support NHA_OP_FLAGS and doesn't have
rtm_nh_policy_del. Can you reproduce the bug with net.git?

> [  647.579548] RIP: 0010:nh_valid_get_del_req+0x38/0xc0
> [  647.998839] Kernel panic - not syncing: Fatal exception
> 
> Fixes: d8a21070b6e1 ("nexthop: Fix out-of-bounds access during attribute validation")
> Signed-off-by: Qing Luo <luoqing@kylinos.cn>