[PATCH net] nexthop: initialize extack in nh_res_bucket_migrate()

[PATCH net] nexthop: initialize extack in nh_res_bucket_migrate()

[Xiang Mei (Microsoft)]

nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
call_nexthop_res_bucket_notifiers(). When
nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns
-ENOMEM), the error is propagated back before any notifier sets
extack._msg, and the error path formats the stale pointer with
pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE
this dereferences uninitialized stack memory:

  Oops: general protection fault, probably for non-canonical address ...
  KASAN: maybe wild-memory-access in range [...]
  RIP: 0010:string (lib/vsprintf.c:730)
   vsnprintf (lib/vsprintf.c:2945)
   _printk (kernel/printk/printk.c:2504)
   nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)
   nh_res_table_upkeep (net/ipv4/nexthop.c:1866)
   rtm_new_nexthop (net/ipv4/nexthop.c:3323)
   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
   netlink_sendmsg (net/netlink/af_netlink.c:1900)
  Kernel panic - not syncing: Fatal exception

Zero-initialize extack so _msg is NULL on error paths that never set it.

Fixes: 7c37c7e00411 ("nexthop: Implement notifiers for resilient nexthop groups")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 net/ipv4/nexthop.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index 6205bd57aa85..44fe75004cac 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -1788,8 +1788,8 @@ static bool nh_res_bucket_migrate(struct nh_res_table *res_table,
 				  bool notify_nl, bool force)
 {
 	struct nh_res_bucket *bucket = &res_table->nh_buckets[bucket_index];
+	struct netlink_ext_ack extack = {};
 	struct nh_grp_entry *new_nhge;
-	struct netlink_ext_ack extack;
 	int err;
 
 	new_nhge = list_first_entry_or_null(&res_table->uw_nh_entries,
-- 
2.43.0

Re: [PATCH net] nexthop: initialize extack in nh_res_bucket_migrate()

[Ido Schimmel]

On Mon, Jul 13, 2026 at 10:15:51PM +0000, Xiang Mei (Microsoft) wrote:
> nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
> call_nexthop_res_bucket_notifiers(). When
> nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns
> -ENOMEM), the error is propagated back before any notifier sets
> extack._msg, and the error path formats the stale pointer with
> pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE
> this dereferences uninitialized stack memory:
> 
>   Oops: general protection fault, probably for non-canonical address ...
>   KASAN: maybe wild-memory-access in range [...]
>   RIP: 0010:string (lib/vsprintf.c:730)
>    vsnprintf (lib/vsprintf.c:2945)
>    _printk (kernel/printk/printk.c:2504)
>    nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)
>    nh_res_table_upkeep (net/ipv4/nexthop.c:1866)
>    rtm_new_nexthop (net/ipv4/nexthop.c:3323)
>    rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
>    netlink_sendmsg (net/netlink/af_netlink.c:1900)
>   Kernel panic - not syncing: Fatal exception
> 
> Zero-initialize extack so _msg is NULL on error paths that never set it.
> 
> Fixes: 7c37c7e00411 ("nexthop: Implement notifiers for resilient nexthop groups")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

It's very unlikely that nh_notifier_res_bucket_info_init() will fail. I
assume that fault injection was used.

remove_nh_grp_entry() also doesn't initialize extack, but
call_nexthop_notifiers() is using NL_SET_ERR_MSG(). Still, the same
problem can happen if a listener is returning an error without setting
extack. Please send a separate patch (targeted at net-next, no Fixes
tag) to make remove_nh_grp_entry() consistent with
nh_res_bucket_migrate().

Re: [PATCH net] nexthop: initialize extack in nh_res_bucket_migrate()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 13 Jul 2026 22:15:51 +0000 you wrote:
> nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
> call_nexthop_res_bucket_notifiers(). When
> nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns
> -ENOMEM), the error is propagated back before any notifier sets
> extack._msg, and the error path formats the stale pointer with
> pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE
> this dereferences uninitialized stack memory:
> 
> [...]

Here is the summary with links:
  - [net] nexthop: initialize extack in nh_res_bucket_migrate()
    https://git.kernel.org/netdev/net/c/6347c5314cee

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net] nexthop: initialize extack in nh_res_bucket_migrate()

[Kalpan Jani]

On Tue, Jul 14, 2026 at 01:44:28PM +0300, Ido Schimmel wrote:
> remove_nh_grp_entry() also doesn't initialize extack, but
> call_nexthop_notifiers() is using NL_SET_ERR_MSG(). Still, the same
> problem can happen if a listener is returning an error without setting
> extack. Please send a separate patch (targeted at net-next, no Fixes
> tag) to make remove_nh_grp_entry() consistent with
> nh_res_bucket_migrate().

Hi Ido,

Noticed this hasn't been picked up yet - happy to send that patch if
nobody else is already on it. Will target net-next, no Fixes tag, and
keep it consistent with your fix above.

Thanks,
Kalpan Jani 

Re: [PATCH net] nexthop: initialize extack in nh_res_bucket_migrate()

[Ido Schimmel]

On Tue, Sep 01, 2026 at 03:18:27PM +0530, Kalpan Jani wrote:
> On Tue, Jul 14, 2026 at 01:44:28PM +0300, Ido Schimmel wrote:
> > remove_nh_grp_entry() also doesn't initialize extack, but
> > call_nexthop_notifiers() is using NL_SET_ERR_MSG(). Still, the same
> > problem can happen if a listener is returning an error without setting
> > extack. Please send a separate patch (targeted at net-next, no Fixes
> > tag) to make remove_nh_grp_entry() consistent with
> > nh_res_bucket_migrate().
> 
> Hi Ido,
> 
> Noticed this hasn't been picked up yet - happy to send that patch if
> nobody else is already on it. Will target net-next, no Fixes tag, and
> keep it consistent with your fix above.

I checked and this does need a Fixes tag. I will send a patch later
today.

Thanks