Re: [PATCH net] mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

[David Ahern <dsahern@gmail.com>]

On 7/12/26 4:09 PM, Xiang Mei wrote:
> On CONFIG_INET=n, mpls_valid_fib_dump_req()'s local strict-check loop
> enters the RTA_OIF arm on the index alone and calls nla_get_u32(tb[i]).
> Since nlmsg_parse_deprecated_strict() leaves tb[i] NULL for any omitted
> attribute, a dump without RTA_OIF dereferences NULL and oopses.
> 
> Skip unset attributes before dispatching on the index, mirroring
> ip_valid_fib_dump_req().
> 
>   Oops: general protection fault, probably for non-canonical address
>   0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
>   KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
>   RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
>   Call Trace:
>    mpls_dump_routes (net/mpls/af_mpls.c:2236)
>    netlink_dump (net/netlink/af_netlink.c:2331)
>    __netlink_dump_start (net/netlink/af_netlink.c:2446)
>    rtnetlink_rcv_msg (net/core/rtnetlink.c:7041)
>    netlink_rcv_skb (net/netlink/af_netlink.c:2556)
>    netlink_unicast (net/netlink/af_netlink.c:1345)
>    netlink_sendmsg (net/netlink/af_netlink.c:1900)
>    __sock_sendmsg (net/socket.c:790)
>    ____sys_sendmsg (net/socket.c:2684)
>    ___sys_sendmsg (net/socket.c:2738)
>    __sys_sendmsg (net/socket.c:2770)
>    do_syscall_64 (arch/x86/entry/syscall_64.c:94)
>    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
>   Kernel panic - not syncing: Fatal exception
> 
> Fixes: 196cfebf8972 ("net/mpls: Handle kernel side filtering of route dumps")
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Xiang Mei <xmei5@asu.edu>
> ---
>  net/mpls/af_mpls.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
> index ca504d9626cf..1ad07df89d5b 100644
> --- a/net/mpls/af_mpls.c
> +++ b/net/mpls/af_mpls.c
> @@ -2185,13 +2185,16 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
>  	for (i = 0; i <= RTA_MAX; ++i) {
>  		int ifindex;
>  
> +		if (!tb[i])
> +			continue;
> +
>  		if (i == RTA_OIF) {
>  			ifindex = nla_get_u32(tb[i]);
>  			filter->dev = dev_get_by_index_rcu(net, ifindex);
>  			if (!filter->dev)
>  				return -ENODEV;
>  			filter->filter_set = 1;
> -		} else if (tb[i]) {
> +		} else {
>  			NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in dump request");
>  			return -EINVAL;
>  		}

Reviewed-by: David Ahern <dsahern@kernel.org>