Skip to contentSkip to conversation

nexthop: Initialize extack in remove_nh_grp_entry()

PATCH Applied Ido Schimmel 3 participants 3 messages Sep 3 – Sep 4

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Ido Schimmel

author maintainer
#0 lore raw

PATCH 1/1 nexthop: Initialize extack in remove_nh_grp_entry()

remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.

Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nh_res_bucket_migrate()").

Fixes 833a1065eeb1 ("nexthop: Emit a notification when a nexthop group is reduced")
Signed-off-by Ido Schimmel <[email protected]>
---
 net/ipv4/nexthop.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/nexthop.c +1 -1
index a7c2b8dced4e..42e55b5a755e 100644
@@ -2036,7 +2036,7 @@ remove_nh_grp_entry(struct net *net, struct nh_grp_entry *nhge,
 {
 	struct nh_grp_entry *nhges, *new_nhges;
 	struct nexthop *nhp = nhge->nh_parent;
-	struct netlink_ext_ack extack;
+	struct netlink_ext_ack extack = {};
 	struct nexthop *nh = nhge->nh;
 	struct nh_group *nhg, *newg;
 	int i, j, err;
Signature · 1 line
2.55.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 8 lines · Ido Schimmel

remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.

Quoted 5 lines

Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nh_res_bucket_migrate()").

Fixes 833a1065eeb1 ("nexthop: Emit a notification when a nexthop group is reduced")
Signed-off-by Ido Schimmel <[email protected]>
Reviewed-by Eric Dumazet <[email protected]>
CI Applied
#2 lore raw
In reply to Ido Schimmel
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Thu, 3 Sep 2026 11:02:59 +0300 you wrote:

remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.

[...]

Here is the summary with links:
- [net] nexthop: Initialize extack in remove_nh_grp_entry()

    https://git.kernel.org/netdev/net/c/5bd9e4e7cdaa

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html