This is a note to let you know that I've just added the patch titled ipv6: Do cleanup if attribute validation fails in multipath route to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipv6-do-cleanup-if-attribute-validation-fails-in-mul.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit a76ad06713337961d3115289f4d24daa5393463e Author: David Ahern <dsahern@xxxxxxxxxx> Date: Mon Jan 3 10:05:55 2022 -0700 ipv6: Do cleanup if attribute validation fails in multipath route [ Upstream commit 95bdba23b5b4aa75fe3e6c84335e638641c707bb ] As Nicolas noted, if gateway validation fails walking the multipath attribute the code should jump to the cleanup to free previously allocated memory. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route") Signed-off-by: David Ahern <dsahern@xxxxxxxxxx> Acked-by: Nicolas Dichtel <nicolas.dichtel@xxxxxxxxx> Link: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@xxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8a437c20eeccd..7e3ab23fc995c 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4466,12 +4466,10 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, nla = nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - int ret; - - ret = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (ret) - return ret; + if (err) + goto cleanup; r_cfg.fc_flags |= RTF_GATEWAY; }