diff options
| author | Thomas Graf <tgraf@suug.ch> | 2016-10-19 23:16:39 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-10-20 11:17:55 -0400 |
| commit | c5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362 (patch) | |
| tree | c31dc181cfc25f036f419ea51a9a806607102e29 /net/ipv6/ila | |
| parent | 7b1536ef0aa0392da7c90cede82e5eacc0f25da3 (diff) | |
| download | lwn-c5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362.tar.gz lwn-c5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362.zip | |
ila: Fix tailroom allocation of lwtstate
Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.
This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.
struct ila_lwt {
struct ila_params p;
struct dst_cache dst_cache;
u32 connected : 1;
};
Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ila')
| -rw-r--r-- | net/ipv6/ila/ila_lwt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c index 9fafba62aaa7..c7a39d07bde8 100644 --- a/net/ipv6/ila/ila_lwt.c +++ b/net/ipv6/ila/ila_lwt.c @@ -122,7 +122,7 @@ static int ila_build_state(struct net_device *dev, struct nlattr *nla, struct ila_lwt *ilwt; struct ila_params *p; struct nlattr *tb[ILA_ATTR_MAX + 1]; - size_t encap_len = sizeof(*p); + size_t encap_len = sizeof(*ilwt); struct lwtunnel_state *newts; const struct fib6_config *cfg6 = cfg; struct ila_addr *iaddr; |