This is a note to let you know that I've just added the patch titled ipv6: Do cleanup if attribute validation fails in multipath route to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipv6-do-cleanup-if-attribute-validation-fails-in-mul.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit f68654c6d4c730a1b0449bec9c03e40fa0c6d70d Author: David Ahern <dsahern@xxxxxxxxxx> Date: Mon Jan 3 10:05:55 2022 -0700 ipv6: Do cleanup if attribute validation fails in multipath route [ Upstream commit 95bdba23b5b4aa75fe3e6c84335e638641c707bb ] As Nicolas noted, if gateway validation fails walking the multipath attribute the code should jump to the cleanup to free previously allocated memory. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route") Signed-off-by: David Ahern <dsahern@xxxxxxxxxx> Acked-by: Nicolas Dichtel <nicolas.dichtel@xxxxxxxxx> Link: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@xxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 230d4af44a300..654bf4ca61260 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5166,12 +5166,10 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, nla = nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - int ret; - - ret = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (ret) - return ret; + if (err) + goto cleanup; r_cfg.fc_flags |= RTF_GATEWAY; }