]> git.baikalelectronics.ru Git - kernel.git/commit
ila: Fix tailroom allocation of lwtstate
authorThomas Graf <tgraf@suug.ch>
Wed, 19 Oct 2016 21:16:39 +0000 (23:16 +0200)
committerDavid S. Miller <davem@davemloft.net>
Thu, 20 Oct 2016 15:17:55 +0000 (11:17 -0400)
commit319de0469c68b42793b1a756de15caa608093280
treec31dc181cfc25f036f419ea51a9a806607102e29
parentf3f2bea6d977803e06d0079a31189ee8f98c25ab
ila: Fix tailroom allocation of lwtstate

Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.

This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.

struct ila_lwt {
struct ila_params p;
struct dst_cache dst_cache;
u32 connected : 1;
};

Fixes: d17ac3faef39 ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ila/ila_lwt.c