Re: [PATCH net] net/ipv6: prevent use after free in ip6_route_mpath_notify
From: Eric Dumazet <hidden>
Date: 2018-06-04 20:45:45
On 06/04/2018 01:41 PM, dsahern@kernel.org wrote:
From: David Ahern <redacted>
syzbot reported a use-after-free:
BUG: KASAN: use-after-free in ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180
Read of size 4 at addr ffff8801bf789cf0 by task syz-executor756/4555
Fix by not setting rt_last until the it is verified the insert succeeded.
Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to RTA_MULTIPATH")
Cc: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <redacted>
Signed-off-by: David Ahern <redacted>
---Reviewed-by: Eric Dumazet <edumazet@google.com> Thanks David !