From: Wei Wang <wei...@google.com> Date: Fri, 18 Aug 2017 17:14:49 -0700
> From: Wei Wang <wei...@google.com> > > In fib6_add(), it is possible that fib6_add_1() picks an intermediate > node and sets the node's fn->leaf to NULL in order to add this new > route. However, if fib6_add_rt2node() fails to add the new > route for some reason, fn->leaf will be left as NULL and could > potentially cause crash when fn->leaf is accessed in fib6_locate(). > This patch makes sure fib6_repair_tree() is called to properly repair > fn->leaf in the above failure case. > > Here is the syzkaller reported general protection fault in fib6_locate: ... > Note: there is no "Fixes" tag as this seems to be a bug introduced > very early. > > Signed-off-by: Wei Wang <wei...@google.com> > Acked-by: Eric Dumazet <eduma...@google.com> Applied and queued up for -stable.
