The attribute tb[RTA_OIF] is dereferenced without verifying if it is NULL. If this attribute is missing in the user netlink message, it will cause a NULL pointer dereference and kernel panic. Add the necessary check before using the pointer to prevent the crash. Signed-off-by: sunichi --- net/mpls/af_mpls.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index d5417688f69e..28bbea30aae3 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -2174,6 +2174,8 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh, int ifindex; if (i == RTA_OIF) { + if (!tb[i]) + return -EINVAL; ifindex = nla_get_u32(tb[i]); filter->dev = dev_get_by_index_rcu(net, ifindex); if (!filter->dev) -- 2.34.1