Created attachment 270516 [details] cause kernel crash in nlattr_get_multipath() In sys/netlink/route/rt.c nlattr_get_multipath(), this code is meant to prevent user code from passing in a too-large nethop array-element length: if (__predict_false(rtnh->rtnh_len <= sizeof(*rtnh) || rtnh->rtnh_len > data_len)) { But the critical use of rtnh_len is: len = NL_ITEM_ALIGN(rtnh->rtnh_len); data_len -= len; And the alignment can increase the value: #define NL_ITEM_ALIGN_SIZE sizeof(uint32_t) #define NL_ITEM_ALIGN(_len) __align_up(_len, NL_ITEM_ALIGN_SIZE) The attached demo program supplies nla->nla_len 71, so data_len starts out 67. The first rtnh_len is 65, which is < 67, but NL_ITEM_ALIGN changes it to 68, so that after subtraction data_len wraps to 65535. Then the loop writes beyond the end of mp->nhops[] into whatever was allocated after it by npt_alloc(). The result (for me) is the kernel dereferencing a garbage pointer and crashing. panic: Fatal page fault at 0xffffffc00076de7e: 0x2000f0008020203 cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x74 --- exception 13, tval = 0x2000f0008020203 post_p_rtnh() at post_p_rtnh+0x12 nl_parse_header() at nl_parse_header+0xa2 nlattr_get_multipath() at nlattr_get_multipath+0xb4 nl_parse_attrs_raw() at nl_parse_attrs_raw+0xb6 nl_parse_header() at nl_parse_header+0x92 rtnl_handle_newroute() at rtnl_handle_newroute+0x58 rtnl_handle_message() at rtnl_handle_message+0x12a nl_taskqueue_handler() at nl_taskqueue_handler+0x49e taskqueue_run_locked() at taskqueue_run_locked+0x158 taskqueue_thread_loop() at taskqueue_thread_loop+0xd4 fork_exit() at fork_exit+0x68 fork_trampoline() at fork_trampoline+0xa KDB: enter: panic FreeBSD 16.0-CURRENT FreeBSD 16.0-CURRENT #10 main-n251024-dc4728f334c9-dirty: Fri May 8 12:05:42 EDT 2026 rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=4329663a861ef74796b79b6b0872cfe10d31c591 commit 4329663a861ef74796b79b6b0872cfe10d31c591 Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-05-12 11:34:28 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-05-13 09:44:28 +0000 rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get Fix length validation of RTA_MULTIPATH attributes in nlattr_get_multipath() by making sure the user request is align. PR: 295102 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: markj Fixes: 7e5bf68495cc ("netlink: add netlink support") MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D56963 sys/netlink/route/rt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Thank you for your report.
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=2c6617658f0cabb1e83a47da02882454e4210bd9 commit 2c6617658f0cabb1e83a47da02882454e4210bd9 Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-05-12 11:34:28 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-05-16 21:21:50 +0000 rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get Fix length validation of RTA_MULTIPATH attributes in nlattr_get_multipath() by making sure the user request is align. PR: 295102 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: markj Fixes: 7e5bf68495cc ("netlink: add netlink support") MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D56963 (cherry picked from commit 4329663a861ef74796b79b6b0872cfe10d31c591) sys/netlink/route/rt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=44be923a2b6bacd664b7e87e486cccd6fcc7cbad commit 44be923a2b6bacd664b7e87e486cccd6fcc7cbad Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-05-12 11:34:28 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-05-16 21:28:09 +0000 rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get Fix length validation of RTA_MULTIPATH attributes in nlattr_get_multipath() by making sure the user request is align. PR: 295102 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: markj Fixes: 7e5bf68495cc ("netlink: add netlink support") MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D56963 (cherry picked from commit 4329663a861ef74796b79b6b0872cfe10d31c591) (cherry picked from commit 2c6617658f0cabb1e83a47da02882454e4210bd9) sys/netlink/route/rt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)