Re: [PATCH net] ipv6: repair fib6 tree in failure case

From: Wei Wang <redacted>
Date: Fri, 18 Aug 2017 17:14:49 -0700

From: Wei Wang <redacted>

In fib6_add(), it is possible that fib6_add_1() picks an intermediate
node and sets the node's fn->leaf to NULL in order to add this new
route. However, if fib6_add_rt2node() fails to add the new
route for some reason, fn->leaf will be left as NULL and could
potentially cause crash when fn->leaf is accessed in fib6_locate().
This patch makes sure fib6_repair_tree() is called to properly repair
fn->leaf in the above failure case.

Here is the syzkaller reported general protection fault in fib6_locate:

 ...

Note: there is no "Fixes" tag as this seems to be a bug introduced
very early.

Signed-off-by: Wei Wang <redacted>
Acked-by: Eric Dumazet <redacted>

Applied and queued up for -stable.