ipv6: Do cleanup if attribute validation fails in multipath route

BugLink: https://bugs.launchpad.net/bugs/1957882
[ Upstream commit 95bdba23b5b4aa75fe3e6c84335e638641c707bb ]

As Nicolas noted, if gateway validation fails walking the multipath
attribute the code should jump to the cleanup to free previously
allocated memory.

Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route")
Signed-off-by: David Ahern <dsahern@kernel.org>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Paolo Pisati <p.pisati@gmail.com>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0eceb0e88976b2a65f9ed1c180d7989ebb41c329..0632382a5427bf5c0d25b75e42d1f72ddb8002fa 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5277,12 +5277,10 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
 
                        nla = nla_find(attrs, attrlen, RTA_GATEWAY);
                        if (nla) {
-                               int ret;
-
-                               ret = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
+                               err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
                                                        extack);
-                               if (ret)
-                                       return ret;
+                               if (err)
+                                       goto cleanup;
 
                                r_cfg.fc_flags |= RTF_GATEWAY;
                        }