Commit c5098ebb authored Oct 19, 2016 by Thomas Graf Committed by David S. Miller Oct 20, 2016

ila: Fix tailroom allocation of lwtstate



Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.

This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.

struct ila_lwt {
	struct ila_params p;
	struct dst_cache dst_cache;
	u32 connected : 1;
};

Fixes: 65d7ab8d ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 7b1536ef

net/ipv6/ila/ila_lwt.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -122,7 +122,7 @@ static int ila_build_state(struct net_device dev, struct nlattr nla,
		struct ila_lwt *ilwt;
		struct ila_params *p;
		struct nlattr *tb[ILA_ATTR_MAX + 1];
		size_t encap_len = sizeof(*p);
		size_t encap_len = sizeof(*ilwt);
		struct lwtunnel_state *newts;
		const struct fib6_config *cfg6 = cfg;
		struct ila_addr *iaddr;

Admin message