From: [email protected] Date: Mon, 4 Jun 2018 13:41:42 -0700 > From: David Ahern <[email protected]> > > syzbot reported a use-after-free: ... > The problem is that rt_last can point to a deleted route if the insert > fails. > > One reproducer is to insert a route and then add a multipath route that > has a duplicate nexthop.e.g,: > $ ip -6 ro add vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::2 > $ ip -6 ro append vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::4 > nexthop via 2001:db8:1::2 > > Fix by not setting rt_last until the it is verified the insert succeeded. > > Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to > RTA_MULTIPATH") > Cc: Eric Dumazet <[email protected]> > Reported-by: syzbot <[email protected]> > Signed-off-by: David Ahern <[email protected]>
Applied and queued up for -stable, thanks David.
