Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: general protection fault in fib_dump_info (2)
To:     Nikolay Aleksandrov <nikolay@cumulusnetworks.com>,
        syzbot <syzbot+a61aa19b0c14c8770bd9@syzkaller.appspotmail.com>,
        davem@davemloft.net, kuba@kernel.org, kuznet@ms2.inr.ac.ru,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org
References: <00000000000039b10005ad64df20@google.com>
 <47e92c2b-c9c5-4c74-70c4-103e70e91630@cumulusnetworks.com>
From:   David Ahern <dsahern@gmail.com>
Message-ID: <6184a09e-04ee-f7f0-81b0-de405b6188ae@gmail.com>
Date:   Fri, 21 Aug 2020 10:05:16 -0600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0)
 Gecko/20100101 Thunderbird/68.11.0
MIME-Version: 1.0
In-Reply-To: <47e92c2b-c9c5-4c74-70c4-103e70e91630@cumulusnetworks.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 8/21/20 10:00 AM, Nikolay Aleksandrov wrote:
> 
> This seems like a much older bug to me, the code allows to pass 0 groups
> and
> thus we end up without any nh_grp_entry pointers. I reproduced it with a
> modified iproute2 that sends an empty NHA_GROUP and then just uses the new
> nexthop in any way (e.g. add a route with it). This is the same bug as the
> earlier report for: "general protection fault in fib_check_nexthop"

hmmm.... empty NHA_GROUP should not be allowed.

> 
> I have a patch but I'll be able to send it tomorrow.
> 

thanks.