From: dsah...@kernel.org
Date: Mon, 4 Jun 2018 13:41:42 -0700
> From: David Ahern <dsah...@gmail.com>
>
> syzbot reported a use-after-free:
...
> The problem is that rt_last can point to a deleted route if the insert
> fails.
>
> One reproducer is to insert a route and then add a multipath route that
> has a duplicate nexthop.e.g,:
> $ ip -6 ro add vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::2
> $ ip -6 ro append vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::4
> nexthop via 2001:db8:1::2
>
> Fix by not setting rt_last until the it is verified the insert succeeded.
>
> Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to
> RTA_MULTIPATH")
> Cc: Eric Dumazet <eduma...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Signed-off-by: David Ahern <dsah...@gmail.com>
Applied and queued up for -stable, thanks David.
