mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
authorKuniyuki Iwashima <kuniyu@google.com>
Thu, 16 Jul 2026 17:06:07 +0000 (17:06 +0000)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 23 Jul 2026 11:36:46 +0000 (13:36 +0200)
commit3671f0419d90b98a02f313830595ab958c8b2025
tree82328ac7c2b0a2416ba97e16946a72a2fc7fa9c5
parent675ed582c1aa4d919dd535490de08c015005c653
mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().

Commit f0914b8436c5 ("mpls: Hold dev refcnt for mpls_nh.") added
change_nexthops() loop to call netdev_put() for the nexthop devices
before freeing mpls_route.

Then, mpls_nh_build_multi() was also changed to avoid iterating
uninitialised nexthops in mpls_rt_free_rcu().

However, setting rt->rt_nhn to 0 at the entry of mpls_nh_build_multi()
makes the following change_nexthops() no-op.

Let's set rt->rt_nhn just before returning from mpls_nh_build_multi().

Fixes: f0914b8436c5 ("mpls: Hold dev refcnt for mpls_nh.")
Reported-by: Anthony Doeraene <anthony.doeraene@uclouvain.be>
Closes: https://lore.kernel.org/netdev/036a0c95-f5d4-46ab-88e7-1eab567d7a84@uclouvain.be/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260716170609.804629-1-kuniyu@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
net/mpls/af_mpls.c