Re: [PATCH net v2] ipv6: fix fib6 walker UAF on NLM_F_REPLACE

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Dave Miller <davem@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>:

On Wed, 28 Oct 2026 12:00:18 -0400 you wrote:
> fib6_walker uses w->leaf to remember the next fib6_info to dump, so an
> RTM_GETROUTE dump can continue there on the next recvmsg().  This
> assumes that whoever removes a route from the tree also updates the
> walkers pointing at it.  fib6_del_route() does: it moves w->leaf to
> the next route.  The NLM_F_REPLACE branch of fib6_add_rt2node() does
> not: it removes the old route, fib6_add() frees it, and w->leaf keeps
> pointing at the freed object.
> 
> [...]

Here is the summary with links:
  - [net,v2] ipv6: fix fib6 walker UAF on NLM_F_REPLACE
    https://git.kernel.org/netdev/net/c/23fec4bd7690

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html