From: Qing Luo rtm_del_nexthop() and nh_valid_get_bucket_req() declare their nlattr tb arrays sized to ARRAY_SIZE(rtm_nh_policy_del) and ARRAY_SIZE(rtm_nh_policy_get_bucket) respectively. Both policies lack an entry for NHA_OP_FLAGS, so the tb arrays are smaller than what nh_valid_get_del_req() accesses via tb[NHA_OP_FLAGS]. This causes an out-of-bounds stack read. The garbage pointer value read from beyond the tb array is then dereferenced in nla_get_u32(), triggering a NULL pointer dereference panic. The bug was introduced when commit 8682b7dd4f6c ("nexthop: Fix out-of-bounds access during attribute validation") shrank the tb arrays from NHA_MAX+1 to ARRAY_SIZE(policy), but the policies were not updated to include NHA_OP_FLAGS even though nh_valid_get_del_req() already accessed that attribute. Add [NHA_OP_FLAGS] entries to rtm_nh_policy_del and rtm_nh_policy_get_bucket so the tb arrays are large enough. [ 647.535111] BUG: kernel NULL pointer dereference, address: 000000000000000a [ 647.542066] #PF: supervisor read access in kernel mode [ 647.547197] #PF: error_code(0x0000) - not-present page [ 647.559218] CPU: 0 PID: 42929 Comm: ip Not tainted 6.6.144 #1 [ 647.579548] RIP: 0010:nh_valid_get_del_req+0x38/0xc0 [ 647.998839] Kernel panic - not syncing: Fatal exception Fixes: d8a21070b6e1 ("nexthop: Fix out-of-bounds access during attribute validation") Signed-off-by: Qing Luo --- net/ipv4/nexthop.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 44fe75004cac..ee1d22e59c00 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -51,6 +51,8 @@ static const struct nla_policy rtm_nh_policy_get[] = { static const struct nla_policy rtm_nh_policy_del[] = { [NHA_ID] = { .type = NLA_U32 }, + [NHA_OP_FLAGS] = NLA_POLICY_MASK(NLA_U32, + NHA_OP_FLAGS_DUMP_ALL), }; static const struct nla_policy rtm_nh_policy_dump[] = { @@ -82,6 +84,8 @@ static const struct nla_policy rtm_nh_res_bucket_policy_dump[] = { static const struct nla_policy rtm_nh_policy_get_bucket[] = { [NHA_ID] = { .type = NLA_U32 }, [NHA_RES_BUCKET] = { .type = NLA_NESTED }, + [NHA_OP_FLAGS] = NLA_POLICY_MASK(NLA_U32, + NHA_OP_FLAGS_DUMP_ALL), }; static const struct nla_policy rtm_nh_res_bucket_policy_get[] = { -- 2.25.1