On Mon, Feb 27, 2017 at 4:14 PM, David Ahern <d...@cumulusnetworks.com> wrote: > On 2/27/17 4:07 PM, Cong Wang wrote: >> Andrey reported a NULL pointer deref bug in ipv6_route_ioctl() >> -> ip6_route_del() -> __ip6_del_rt_siblings() code path. This is >> because ip6_null_entry is returned in this path since ip6_null_entry >> is kinda default for a ipv6 route table root node. Quote from > > > Missed this earlier. The issue here is an attempt to delete the NULL > route, not that the null_entry is being returned as happens during a > route lookup. This will also hit the bug: > ip -6 ro del ::/0
By "returned" I mean it is in the fn->leaf list.
