===MODEL PATCH ===

--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -1088,6 +1088,10 @@
 static int insert_nexthop(struct net *net, struct nexthop *new_nh,
 			  struct nh_config *cfg, struct netlink_ext_ack *extack)
 {
+	if (!(cfg->nlflags & (NLM_F_CREATE | NLM_F_REPLACE))) {
+		NL_SET_ERR_MSG(extack, "Either NLM_F_CREATE or NLM_F_REPLACE must be specified");
+		return -EINVAL;
+	}
 	struct rb_node **pp, *parent = NULL, *next;
 	struct rb_root *root = &net->nexthop.rb_root;
 	bool replace = !!(cfg->nlflags & NLM_F_REPLACE);

===ORIGINAL PATCH ===
diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index cc8049b100b2..134e92382275 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -446,7 +446,7 @@ static int nh_check_attr_group(struct net *net, struct nlattr *tb[],
 	unsigned int i, j;
 	u8 nhg_fdb = 0;
 
-	if (len & (sizeof(struct nexthop_grp) - 1)) {
+	if (!len || len & (sizeof(struct nexthop_grp) - 1)) {
 		NL_SET_ERR_MSG(extack,
 			       "Invalid length for nexthop group attribute");
 		return -EINVAL;
@@ -1187,6 +1187,9 @@ static struct nexthop *nexthop_create_group(struct net *net,
 	struct nexthop *nh;
 	int i;
 
+	if (WARN_ON(!num_nh))
+		return ERR_PTR(-EINVAL);
+
 	nh = nexthop_alloc();
 	if (!nh)
 		return ERR_PTR(-ENOMEM);

