On 6/20/19 3:10 AM, Ido Schimmel wrote:
> From: Ido Schimmel <ido...@mellanox.com>
>
> When user space sends invalid information in RTA_MULTIPATH, the nexthop
> list in ip6_route_multipath_add() is empty and 'rt_notif' is set to
> NULL.
>
> The code that emits the in-kernel notifications does not check for this
> condition, which results in a NULL pointer dereference [1].
>
> Fix this by bailing earlier in the function if the parsed nexthop list
> is empty. This is consistent with the corresponding IPv4 code.
>
> v2:
> * Check if parsed nexthop list is empty and bail with extack set
>
...
>
> Reported-by: syzbot+382566d339d52cd1a...@syzkaller.appspotmail.com
> Fixes: ebee3cad835f ("ipv6: Add IPv6 multipath notifications for add /
> replace")
> Signed-off-by: Ido Schimmel <ido...@mellanox.com>
> ---
> net/ipv6/route.c | 6 ++++++
> 1 file changed, 6 insertions(+)
Reviewed-by: David Ahern <dsah...@gmail.com>
