* [PATCH net] ila: Fix tailroom allocation of lwtstate
@ 2016-10-19 21:16 Thomas Graf
2016-10-20 15:20 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Thomas Graf @ 2016-10-19 21:16 UTC (permalink / raw)
To: davem, tom; +Cc: netdev
Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.
This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.
struct ila_lwt {
struct ila_params p;
struct dst_cache dst_cache;
u32 connected : 1;
};
Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
---
-stable candidate
net/ipv6/ila/ila_lwt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index 9fafba6..c7a39d0 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -122,7 +122,7 @@ static int ila_build_state(struct net_device *dev, struct nlattr *nla,
struct ila_lwt *ilwt;
struct ila_params *p;
struct nlattr *tb[ILA_ATTR_MAX + 1];
- size_t encap_len = sizeof(*p);
+ size_t encap_len = sizeof(*ilwt);
struct lwtunnel_state *newts;
const struct fib6_config *cfg6 = cfg;
struct ila_addr *iaddr;
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] ila: Fix tailroom allocation of lwtstate
2016-10-19 21:16 [PATCH net] ila: Fix tailroom allocation of lwtstate Thomas Graf
@ 2016-10-20 15:20 ` David Miller
2016-10-20 15:52 ` Thomas Graf
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2016-10-20 15:20 UTC (permalink / raw)
To: tgraf; +Cc: tom, netdev
From: Thomas Graf <tgraf@suug.ch>
Date: Wed, 19 Oct 2016 23:16:39 +0200
> Tailroom is supposed to be of length sizeof(struct ila_lwt) but
> sizeof(struct ila_params) is currently allocated.
>
> This leads to the dst_cache and connected member of ila_lwt being
> referenced out of bounds.
>
> struct ila_lwt {
> struct ila_params p;
> struct dst_cache dst_cache;
> u32 connected : 1;
> };
>
> Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
> Signed-off-by: Thomas Graf <tgraf@suug.ch>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> -stable candidate
This patch only applies to net-next, so I've applied it there.
Please explain how I should handle 'net' and -stable.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] ila: Fix tailroom allocation of lwtstate
2016-10-20 15:20 ` David Miller
@ 2016-10-20 15:52 ` Thomas Graf
0 siblings, 0 replies; 3+ messages in thread
From: Thomas Graf @ 2016-10-20 15:52 UTC (permalink / raw)
To: David Miller; +Cc: tom, netdev
On 10/20/16 at 11:20am, David Miller wrote:
> This patch only applies to net-next, so I've applied it there.
>
> Please explain how I should handle 'net' and -stable.
The presence of ila_params_lwtunnel() in 'net' lead me to believe that
'net' is affected as well. It is not. Applying to 'net-next' only is
fine.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-10-20 15:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-19 21:16 [PATCH net] ila: Fix tailroom allocation of lwtstate Thomas Graf
2016-10-20 15:20 ` David Miller
2016-10-20 15:52 ` Thomas Graf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).