FreeBSD.org/src/commit/?id=e22716b6cbfcb4c9ff1900f19c923fb84aebcae1 commit e22716b6cbfcb4c9ff1900f19c923fb84aebcae1 Author: Ed Maste AuthorDate: 2026-05-22 14:41:16 +0000 Commit: Ed Maste CommitDate: 2026-06-09 13:40:29 +0000 netlink: Check for NULL return from npt_alloc() Reviewed by: glebius, pouria Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57171 (cherry picked from commit 1dbc104148845434575d1931d47876ae0ca1542f) --- sys/netlink/netlink_message_parser.c | 2 ++ sys/netlink/route/iface_drivers.c | 3 +++ sys/netlink/route/rt.c | 4 ++++ 3 files changed, 9 insertions(+) diff --git a/sys/netlink/netlink_message_parser.c b/sys/netlink/netlink_message_parser.c index 4c41235efaac..37c16ce3024f 100644 --- a/sys/netlink/netlink_message_parser.c +++ b/sys/netlink/netlink_message_parser.c @@ -90,6 +90,8 @@ nlmsg_report_cookie_u32(struct nl_pstate *npt, uint32_t val) { struct nlattr *nla = npt_alloc(npt, sizeof(*nla) + sizeof(uint32_t)); + if (nla == NULL) + return; nla->nla_type = NLMSGERR_ATTR_COOKIE; nla->nla_len = sizeof(*nla) + sizeof(uint32_t); memcpy(nla + 1, &val, sizeof(uint32_t)); diff --git a/sys/netlink/route/iface_drivers.c b/sys/netlink/route/iface_drivers.c index 4f1540740ead..31d2523a479b 100644 --- a/sys/netlink/route/iface_drivers.c +++ b/sys/netlink/route/iface_drivers.c @@ -155,6 +155,9 @@ _nl_store_ifp_cookie(struct nl_pstate *npt, struct ifnet *ifp) sizeof(ifindex) + NL_ITEM_ALIGN(ifname_len + 1); struct nlattr *nla_cookie = npt_alloc(npt, nla_len); + if (nla_cookie == NULL) + return; + /* Nested TLV */ nla_cookie->nla_len = nla_len; nla_cookie->nla_type = NLMSGERR_ATTR_COOKIE; diff --git a/sys/netlink/route/rt.c b/sys/netlink/route/rt.c index a76e00d34502..42ba3307b816 100644 --- a/sys/netlink/route/rt.c +++ b/sys/netlink/route/rt.c @@ -868,6 +868,10 @@ create_nexthop_from_attrs(struct nl_parsed_route *attrs, int num_nhops = attrs->rta_multipath->num_nhops; struct weightened_nhop *wn = npt_alloc(npt, sizeof(*wn) * num_nhops); + if (wn == NULL) { + *perror = ENOMEM; + return (NULL); + } for (int i = 0; i < num_nhops; i++) { struct rta_mpath_nh *mpnh = &attrs->rta_multipath->nhops[i];