On 06/04/2018 01:41 PM, dsah...@kernel.org wrote:
> From: David Ahern <dsah...@gmail.com>
>
> syzbot reported a use-after-free:
>
> BUG: KASAN: use-after-free in ip6_route_mpath_notify+0xe9/0x100
> net/ipv6/route.c:4180
> Read of size 4 at addr ffff8801bf789cf0 by task syz-executor756/4555
>
> Fix by not setting rt_last until the it is verified the insert succeeded.
>
> Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to
> RTA_MULTIPATH")
> Cc: Eric Dumazet <eduma...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Signed-off-by: David Ahern <dsah...@gmail.com>
> ---
Reviewed-by: Eric Dumazet <eduma...@google.com>
Thanks David !
