From: Ido Schimmel <ido...@idosch.org>
Date: Thu, 20 Jun 2019 12:10:21 +0300
> From: Ido Schimmel <ido...@mellanox.com>
>
> When user space sends invalid information in RTA_MULTIPATH, the nexthop
> list in ip6_route_multipath_add() is empty and 'rt_notif' is set to
> NULL.
>
> The code that emits the in-kernel notifications does not check for this
> condition, which results in a NULL pointer dereference [1].
>
> Fix this by bailing earlier in the function if the parsed nexthop list
> is empty. This is consistent with the corresponding IPv4 code.
>
> v2:
> * Check if parsed nexthop list is empty and bail with extack set
>
> [1]
...
>
> Reported-by: syzbot+382566d339d52cd1a...@syzkaller.appspotmail.com
> Fixes: ebee3cad835f ("ipv6: Add IPv6 multipath notifications for add /
> replace")
> Signed-off-by: Ido Schimmel <ido...@mellanox.com>
Applied.
