Subject: Re: [PATCH net] ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()

From: Jakub Kicinski <[email-masked]>
Date: Tue, 31 Mar 2026 10:35:38 -0700

On Tue, 31 Mar 2026 13:59:43 +0200 Fernando Fernandez Mancera wrote:
> When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently
> allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for
> single nexthops and small Equal-Cost Multi-Path groups, this fixed
> allocation fails for large nexthop groups like 512+ nexthops.

router_mpath_seed.sh says:

[    9.366434] WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x181/0x1b0, CPU#0: ip/342
[    9.366490] Modules linked in: vrf veth
[    9.366519] CPU: 0 UID: 0 PID: 342 Comm: ip Not tainted 7.0.0-rc5-virtme #1 PREEMPT(lazy) 
[    9.366567] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    9.366610] RIP: 0010:rtm_get_nexthop+0x181/0x1b0
[    9.366649] Code: 25 a7 ee ff eb 80 48 c7 c7 a0 ee af ae e8 57 30 f5 ff 4d 85 ed 74 08 49 c7 45 00 a0 ee af ae b8 ea ff ff ff e9 5d ff ff ff 90 <0f> 0b 90 ba 02 00 00 00 4c 89 ee 31 ff e8 2d 84 eb ff b8 a6 ff ff
[    9.366754] RSP: 0018:ff5db175808bf9d8 EFLAGS: 00010286
[    9.366790] RAX: 00000000ffffffa6 RBX: ff3c7cb941dab700 RCX: 0000000000000000
[    9.366835] RDX: 0000000000000003 RSI: 0000000000000000 RDI: ff3c7cb94404a300
[    9.366872] RBP: ff3c7cb94404a400 R08: ff3c7cb9413f25a8 R09: ff3c7cb94196cb40
[    9.366916] R10: ff3c7cb94196ca00 R11: 000000000000000e R12: ffffffffaf8df6c0
[    9.366967] R13: ff3c7cb94404a300 R14: ff3c7cb94525e180 R15: ff3c7cb94404a400
[    9.367018] FS:  00007fa1f5261440(0000) GS:ff3c7cb9cf3fb000(0000) knlGS:0000000000000000
[    9.367064] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    9.367102] CR2: 000000000044f720 CR3: 000000000573f001 CR4: 0000000000771ef0
[    9.367149] PKRU: 55555554
[    9.367165] Call Trace:
[    9.367183]  <TASK>
[    9.367201]  rtnetlink_rcv_msg+0x13a/0x3e0
[    9.367227]  ? get_page_from_freelist+0x1109/0x16c0
[    9.367259]  ? rtnl_calcit.isra.0+0x120/0x120
[    9.367286]  netlink_rcv_skb+0x59/0x100
[    9.367310]  netlink_unicast+0x255/0x380
[    9.367333]  netlink_sendmsg+0x1cc/0x3e0
[    9.367356]  ____sys_sendmsg+0x164/0x260
[    9.367390]  ___sys_sendmsg+0x99/0xe0
[    9.367415]  __sys_sendmsg+0x8a/0xe0
[    9.367441]  do_syscall_64+0x101/0xfc0
[    9.367466]  ? exc_page_fault+0x6e/0x170
[    9.367493]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[    9.367528] RIP: 0033:0x7fa1f53bbc5e
[    9.367550] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
[    9.367653] RSP: 002b:00007ffc00947ff0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
[    9.367700] RAX: ffffffffffffffda RBX: 000000000048ba90 RCX: 00007fa1f53bbc5e
[    9.367744] RDX: 0000000000000000 RSI: 00007ffc009480b0 RDI: 0000000000000005
[    9.367787] RBP: 00007ffc00948000 R08: 0000000000000000 R09: 0000000000000000
[    9.367835] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000049d620
[    9.367889] R13: 0000000069cbe823 R14: 0000000000000004 R15: 000000000049d620

decoded:
https://netdev-ctrl.bots.linux.dev/logs/vmksft/forwarding/results/582821/vm-crash-thr4-1