forked from luck/tmp_suning_uos_patched
[XFRM]: Fix crash introduced by struct dst_entry reordering
XFRM expects xfrm_dst->u.next to be same pointer as dst->next, which was broken by the dst_entry reordering in commit 1e19e02c~, causing an oops in xfrm_bundle_ok when walking the bundle upwards. Kill xfrm_dst->u.next and change the only user to use dst->next instead. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
16751347a0
commit
bd0bf0765e
|
@ -585,7 +585,6 @@ static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ct
|
|||
struct xfrm_dst
|
||||
{
|
||||
union {
|
||||
struct xfrm_dst *next;
|
||||
struct dst_entry dst;
|
||||
struct rtable rt;
|
||||
struct rt6_info rt6;
|
||||
|
|
|
@ -2141,7 +2141,7 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
|
|||
if (last == first)
|
||||
break;
|
||||
|
||||
last = last->u.next;
|
||||
last = (struct xfrm_dst *)last->u.dst.next;
|
||||
last->child_mtu_cached = mtu;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user