hi
  AFAIU, there is a race condition in multipath_drr code,
these code paths try to access & change last_selection variable
without any synchronization.

Please correct me if I am wrong.

Code Path - 1

__ip_route_output_key(...)
{
   ...
   calls drr_select_route
       if(FLOWI_FLAG_MULTIPATHOLDROUTE set){
           check last_selection.
           return  last_selection //so it can return NULL  pointer
       }
   ....
}

Code Path - 2  

rt_secret_rebuild()
{
.....
rt_run_flush(..);
      ->rt_free(rth);
              -> multipath_remove(rt)
                      ->drr_remove()
                              reset last_selection.
....
}

Attached patch also fixes bug in function drr_init ::
multipath_alg_register(..) is called with wrong algorithm ID.


Regards
Pravin.