]> git.baikalelectronics.ru Git - kernel.git/commit
ipv6: Unlink sibling route in case of failure
authorIdo Schimmel <idosch@mellanox.com>
Wed, 17 Jul 2019 20:39:33 +0000 (23:39 +0300)
committerDavid S. Miller <davem@davemloft.net>
Thu, 18 Jul 2019 19:01:43 +0000 (12:01 -0700)
commit5cda350d1a46914f5f8a6e0a1d01c1cd034448cb
treefba907d148c12907775359f71496f2aded27f53f
parent26856a3f05d19072bd4892cd437655ba95bbc28c
ipv6: Unlink sibling route in case of failure

When a route needs to be appended to an existing multipath route,
fib6_add_rt2node() first appends it to the siblings list and increments
the number of sibling routes on each sibling.

Later, the function notifies the route via call_fib6_entry_notifiers().
In case the notification is vetoed, the route is not unlinked from the
siblings list, which can result in a use-after-free.

Fix this by unlinking the route from the siblings list before returning
an error.

Audited the rest of the call sites from which the FIB notification chain
is called and could not find more problems.

Fixes: 9ac21e451a12 ("net/ipv6: Move call_fib6_entry_notifiers up for route adds")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ip6_fib.c