Re: [PATCH net v1] net: nexthop: fix panic when IPv4 route references IPv6 nexthop

[Eric Dumazet]

On Sat, Feb 28, 2026 at 5:33 PM David Ahern <dsahern@xxxxxxxxxx> wrote:
>
> On 2/28/26 8:39 AM, Jakub Kicinski wrote:
> > On Sat, 28 Feb 2026 11:13:59 +0800 Jiayuan Chen wrote:
> >> From: Jiayuan Chen <jiayuan.chen@xxxxxxxxxx>
> >>
> >> fib_check_nexthop() does not validate that the nexthop family matches
> >> the route family. This allows an IPv4 route to reference an IPv6
> >> nexthop object. When the IPv4 route is looked up, __mkroute_output()
> >> accesses nhc->nhc_pcpu_rth_output which is never allocated for IPv6
> >> nexthops (fib6_nh_init does not call fib_nh_common_init), causing a
> >> NULL pointer dereference.
> >>
> >> Note that this is not about IPv4 routes with IPv6 gateways (RFC 5549),
> >> which uses an AF_INET nexthop with nhc_gw_family=AF_INET6 and properly
> >> allocates nhc_pcpu_rth_output via fib_nh_common_init(). The bug here
> >> is an AF_INET6 nexthop object being directly referenced by an IPv4
> >> route, which is an invalid combination.
> >>
> >> Add the missing family check in fib_check_nexthop(), mirroring what
> >> fib6_check_nexthop() already does for the reverse direction (rejecting
> >> IPv6 routes that reference IPv4 nexthop objects).
> >
> > AFAICT this breaks a bunch of tests, quickest to repro with is
> > gre_multipath_nh.sh but you should probably run fib_nexthops.sh
> > on your fix as well.
> >
>
> nothing to fix. The patch is wrong. IPv4 supports IPv6 gateways; that is
> a known feature.
>
> please post the stack trace for the panic

https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@xxxxxxxxxx/T/