Commit 1ff15a71 authored by David Ahern's avatar David Ahern Committed by David S. Miller
Browse files

ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route 



Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold
an IPv6 address.

Fixes: 6b9ea5a6 ("ipv6: fix multipath route replace error recovery")
Signed-off-by: default avatarDavid Ahern <dsahern@kernel.org>
Cc: Roopa Prabhu <roopa@nvidia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4619bcf9

net/ipv6/route.c

+5 −1
Original line number Diff line number Diff line
@@ -5453,7 +5453,11 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, 


			nla = nla_find(attrs, attrlen, RTA_GATEWAY);

			if (nla) {

				nla_memcpy(&r_cfg.fc_gateway, nla, 16);

				err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,

							extack);

				if (err)

					return err;



				r_cfg.fc_flags |= RTF_GATEWAY;

			}

		}