Re: [PATCH net v1] net: nexthop: fix panic when IPv4 route references IPv6 nexthop

[David Ahern]

On 2/28/26 8:39 AM, Jakub Kicinski wrote:
> On Sat, 28 Feb 2026 11:13:59 +0800 Jiayuan Chen wrote:
>> From: Jiayuan Chen <jiayuan.chen@xxxxxxxxxx>
>>
>> fib_check_nexthop() does not validate that the nexthop family matches
>> the route family. This allows an IPv4 route to reference an IPv6
>> nexthop object. When the IPv4 route is looked up, __mkroute_output()
>> accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6
>> nexthops (fib6_nh_init does not call fib_nh_common_init), causing a
>> NULL pointer dereference.
>>
>> Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549),
>> which uses an AF_INET nexthop with nhc_gw_family=AF_INET6 and properly
>> allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here
>> is an AF_INET6 nexthop object being directly referenced by an IPv4
>> route, which is an invalid combination.
>>
>> Add the missing family check in fib_check_nexthop(), mirroring what
>> fib6_check_nexthop() already does for the reverse direction (rejecting
>> IPv6 routes that reference IPv4 nexthop objects).
> 
> AFAICT this breaks a bunch of tests, quickest to repro with is
> gre_multipath_nh.sh but you should probably run fib_nexthops.sh
> on your fix as well.
> 

nothing to fix. The patch is wrong. IPv4 supports IPv6 gateways; that is
a known feature.

please post the stack trace for the panic