ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route

commit 1ff15a710a862db1101b97810af14aedc835a86a upstream.

Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold
an IPv6 address.

Fixes: 6b9ea5a64ed5 ("ipv6: fix multipath route replace error recovery")
Signed-off-by: David Ahern <dsahern@kernel.org>
Cc: Roopa Prabhu <roopa@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5daef939656627a2b9c6a2193ffb4a3620c1f765..9ae48a20c3207c63e9212c63d38f52d55ed5cd02 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3365,7 +3365,11 @@ static int ip6_route_multipath_del(struct fib6_config *cfg,
 
                        nla = nla_find(attrs, attrlen, RTA_GATEWAY);
                        if (nla) {
-                               nla_memcpy(&r_cfg.fc_gateway, nla, 16);
+                               err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
+                                                       extack);
+                               if (err)
+                                       return err;
+
                                r_cfg.fc_flags |= RTF_GATEWAY;
                        }
                }