summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorThomas Graf <tgraf@suug.ch>2016-10-19 23:16:39 +0200
committerDavid S. Miller <davem@davemloft.net>2016-10-20 11:17:55 -0400
commitc5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362 (patch)
treec31dc181cfc25f036f419ea51a9a806607102e29 /net
parent7b1536ef0aa0392da7c90cede82e5eacc0f25da3 (diff)
downloadlinux-c5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362.tar.gz
linux-c5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362.tar.bz2
linux-c5098ebbd6605e7ba1fd1dbfe4c1297ac2ab7362.zip
ila: Fix tailroom allocation of lwtstate
Tailroom is supposed to be of length sizeof(struct ila_lwt) but sizeof(struct ila_params) is currently allocated. This leads to the dst_cache and connected member of ila_lwt being referenced out of bounds. struct ila_lwt { struct ila_params p; struct dst_cache dst_cache; u32 connected : 1; }; Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module") Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/ila/ila_lwt.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index 9fafba62aaa7..c7a39d07bde8 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -122,7 +122,7 @@ static int ila_build_state(struct net_device *dev, struct nlattr *nla,
struct ila_lwt *ilwt;
struct ila_params *p;
struct nlattr *tb[ILA_ATTR_MAX + 1];
- size_t encap_len = sizeof(*p);
+ size_t encap_len = sizeof(*ilwt);
struct lwtunnel_state *newts;
const struct fib6_config *cfg6 = cfg;
struct ila_addr *iaddr;