From: David Ahern <d...@cumulusnetworks.com>
Date: Fri, 17 Mar 2017 16:07:11 -0700
> The VRF driver takes a reference to the inet6_dev on the VRF device for
> its rt6_local dst when handling local traffic through the VRF device as
> a loopback. When the device is deleted the driver does a put on the idev
> but does not reset rt6i_idev in the rt6_info struct. When the dst is
> destroyed, dst_destroy calls ip6_dst_destroy which does a second put for
> what is essentially the same reference causing it to be prematurely freed.
> Reset rt6i_idev after the put in the vrf driver.
>
> Fixes: b4869aa2f881e ("net: vrf: ipv6 support for local traffic to
> local addresses")
> Signed-off-by: David Ahern <d...@cumulusnetworks.com>
Applied and queued up for -stable.
