From d256e153799b73aecdb46b32f401dd7b20bf7980 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 7 Jul 2026 11:45:22 +0000 Subject: [PATCH 1/3] rtnl: fix stack buffer overflow parsing IFLA_LINKINFO uc_nl_convert_rta_linkinfo() declared the attribute table as linkinfo_tb[IFLA_INFO_MAX] but passed IFLA_INFO_MAX as the maxtype to nla_parse(), which zero-initialises maxtype + 1 pointers and can store into index IFLA_INFO_MAX (IFLA_INFO_SLAVE_DATA), one past the end of the array. Size the table IFLA_INFO_MAX + 1 as the other attribute tables in this file do. Reachable by any RTM_GETLINK on an interface carrying IFLA_LINKINFO, such as a bridge, VLAN or veth. Signed-off-by: Felix Fietkau --- lib/rtnl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rtnl.c b/lib/rtnl.c index 5e71e59b..e771b471 100644 --- a/lib/rtnl.c +++ b/lib/rtnl.c @@ -1992,7 +1992,7 @@ uc_nl_convert_rta_linkinfo_data(uc_value_t *obj, size_t attr, struct nl_msg *msg static uc_value_t * uc_nl_convert_rta_linkinfo(const uc_nl_attr_spec_t *spec, struct nl_msg *msg, struct nlattr **tb, uc_vm_t *vm) { - struct nlattr *linkinfo_tb[IFLA_INFO_MAX]; + struct nlattr *linkinfo_tb[IFLA_INFO_MAX + 1]; uc_value_t *info_obj, *slave_obj; if (!tb[spec->attr]) From f741ac0a144cf1a8c44172f8d8e362ba8014d0ec Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 7 Jul 2026 11:45:33 +0000 Subject: [PATCH 2/3] rtnl: fix stack buffer overflow parsing RTA_MULTIPATH nexthops uc_nl_convert_rta_multipath() passed RTA_MAX + 1 as the maxtype to nla_parse() while the attribute table multipath_tb was sized RTA_MAX + 1. nla_parse() zero-initialises maxtype + 1 pointers, so it wrote one pointer past the end of the array. Pass RTA_MAX as the maxtype, matching the table size convention. Reachable by any RTM_GETROUTE result containing a multipath route. Signed-off-by: Felix Fietkau --- lib/rtnl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rtnl.c b/lib/rtnl.c index e771b471..a41cccd3 100644 --- a/lib/rtnl.c +++ b/lib/rtnl.c @@ -1679,7 +1679,7 @@ uc_nl_convert_rta_multipath(const uc_nl_attr_spec_t *spec, struct nl_msg *msg, s nh_obj = ucv_object_new(vm); ucv_array_push(nh_arr, nh_obj); - nla_parse(multipath_tb, RTA_MAX + 1, (struct nlattr *)RTNH_DATA(nh), nh->rtnh_len - sizeof(*nh), NULL); + nla_parse(multipath_tb, RTA_MAX, (struct nlattr *)RTNH_DATA(nh), nh->rtnh_len - sizeof(*nh), NULL); if (multipath_tb[RTA_GATEWAY]) { switch (nla_len(multipath_tb[RTA_GATEWAY])) { From c41310f7c2dffd488c182a1a1ec811950df0a936 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 7 Jul 2026 11:45:46 +0000 Subject: [PATCH 3/3] rtnl: fix inverted address check in multipath nexthop parsing uc_nl_parse_rta_nexthop() treated a successful parse of the nexthop 'via' address as a failure: uc_nl_parse_cidr() returns true on success, but the code returned false in that case. Every attempt to add a route with a multipath nexthop therefore failed. Negate the check to match the other caller of uc_nl_parse_cidr() in this file. Signed-off-by: Felix Fietkau --- lib/rtnl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rtnl.c b/lib/rtnl.c index a41cccd3..a784a282 100644 --- a/lib/rtnl.c +++ b/lib/rtnl.c @@ -1563,7 +1563,7 @@ uc_nl_parse_rta_nexthop(struct nl_msg *msg, uc_vm_t *vm, uc_value_t *val) if (ucv_type(val) != UC_OBJECT) return false; - if (uc_nl_parse_cidr(vm, ucv_object_get(val, "via", NULL), &cidr)) + if (!uc_nl_parse_cidr(vm, ucv_object_get(val, "via", NULL), &cidr)) return false; aflen = (cidr.family == AF_INET6 ? sizeof(cidr.addr.in6) : sizeof(cidr.addr.in));