[PATCH grout] ip: fix crash on uninit nexthop dereference

Andrei Rybchenko rybchenko.andrei at gmail.com
Thu Sep 10 14:46:15 CEST 2026


Ensure that nexthop is always initialized in l3_mbuf_data.

Fixes: ad3093cecffa ("ip,ip6: unify L3 output mbuf data type")
Fixes: e5570d2ad6bf ("policy: add stateful dynamic source nat support")
Signed-off-by: Andrei Rybchenko <rybchenko.andrei at gmail.com>
---
 modules/ip/datapath/ip_input.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/modules/ip/datapath/ip_input.c b/modules/ip/datapath/ip_input.c
index 68454c4b..96878b35 100644
--- a/modules/ip/datapath/ip_input.c
+++ b/modules/ip/datapath/ip_input.c
@@ -152,9 +152,6 @@ ip_input_process(struct rte_graph *graph, struct rte_node *node, void **objs, ui
 			goto next;
 		}
 
-		// Store the resolved next hop for ip_output to avoid a second route lookup.
-		l3_mbuf_data(mbuf)->nh = nh;
-
 		edge = nh_type_edges[nh->type];
 		if (edge != FORWARD)
 			goto next;
@@ -190,6 +187,8 @@ next:
 			struct rte_ipv4_hdr *t = gr_mbuf_trace_add(mbuf, node, sizeof(*t));
 			*t = *ip;
 		}
+		// Store the resolved next hop for ip_output to avoid a second route lookup or NULL.
+		l3_mbuf_data(mbuf)->nh = nh;
 		rte_node_enqueue_x1(graph, node, edge, mbuf);
 	}
 
-- 
2.47.3



More information about the grout mailing list