From: Jiayuan Chen fib_check_nexthop() does not validate that the nexthop family matches the route family. This allows an IPv4 route to reference an IPv6 nexthop object. When the IPv4 route is looked up, __mkroute_output() accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6 nexthops (fib6_nh_init does not call fib_nh_common_init), causing a NULL pointer dereference. Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549), which uses an AF_INET nexthop with nhc_gw_family=AF_INET6 and properly allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here is an AF_INET6 nexthop object being directly referenced by an IPv4 route, which is an invalid combination. Add the missing family check in fib_check_nexthop(), mirroring what fib6_check_nexthop() already does for the reverse direction (rejecting IPv6 routes that reference IPv4 nexthop objects). Reproducer: unshare -rn ip link set lo up ip nexthop add id 100 via fe80::1 dev lo ip route add 172.20.20.0/24 nhid 100 ping -c1 172.20.20.1 After fix: ... $ ip route add 172.20.20.0/24 nhid 100 Error: IPv4 routes can not use an IPv6 nexthop. Reported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/ Fixes: 4c7e8084fd46 ("ipv4: Plumb support for nexthop object in a fib_info") Signed-off-by: Jiayuan Chen --- net/ipv4/nexthop.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 7b9d70f9b31c..0f236110cd58 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -1634,6 +1634,12 @@ int fib_check_nexthop(struct nexthop *nh, u8 scope, goto out; } + if (!nhg->has_v4) { + NL_SET_ERR_MSG(extack, "IPv4 routes can not use an IPv6 nexthop"); + err = -EINVAL; + goto out; + } + if (scope == RT_SCOPE_HOST) { NL_SET_ERR_MSG(extack, "Route with host scope can not have multiple nexthops"); err = -EINVAL; @@ -1650,6 +1656,11 @@ int fib_check_nexthop(struct nexthop *nh, u8 scope, err = -EINVAL; goto out; } + if (nhi->family != AF_INET) { + NL_SET_ERR_MSG(extack, "IPv4 routes can not use an IPv6 nexthop"); + err = -EINVAL; + goto out; + } err = nexthop_check_scope(nhi, scope, extack); } -- 2.43.0