tmp_suning_uos_patched/net/ipv6/ila
Thomas Graf c5098ebbd6 ila: Fix tailroom allocation of lwtstate
Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.

This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.

struct ila_lwt {
	struct ila_params p;
	struct dst_cache dst_cache;
	u32 connected : 1;
};

Fixes: 65d7ab8de5 ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-10-20 11:17:55 -04:00
..
ila_common.c kcm: Use stream parser 2016-08-17 19:36:23 -04:00
ila_lwt.c ila: Fix tailroom allocation of lwtstate 2016-10-20 11:17:55 -04:00
ila_xlat.c ila: make nla_policy const 2016-09-01 14:09:01 -07:00
ila.h ila: Perform only one translation in forwarding path 2016-06-08 00:40:34 -07:00
Makefile ila: Add generic ILA translation facility 2015-12-15 23:25:20 -05:00