lkml.org 
[lkml]   [2007]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[2.6.22.2 review 04/84] Fix IPCOMP crashes.

    From: Patrick McHardy <kaber@trash.net>

    [XFRM]: Fix crash introduced by struct dst_entry reordering

    XFRM expects xfrm_dst->u.next to be same pointer as dst->next, which
    was broken by the dst_entry reordering in commit 1e19e02c~, causing
    an oops in xfrm_bundle_ok when walking the bundle upwards.

    Kill xfrm_dst->u.next and change the only user to use dst->next instead.

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    include/net/xfrm.h | 1 -
    net/xfrm/xfrm_policy.c | 2 +-
    2 files changed, 1 insertion(+), 2 deletions(-)

    --- a/include/net/xfrm.h
    +++ b/include/net/xfrm.h
    @@ -577,7 +577,6 @@ static inline int xfrm_sec_ctx_match(str
    struct xfrm_dst
    {
    union {
    - struct xfrm_dst *next;
    struct dst_entry dst;
    struct rtable rt;
    struct rt6_info rt6;
    --- a/net/xfrm/xfrm_policy.c
    +++ b/net/xfrm/xfrm_policy.c
    @@ -2141,7 +2141,7 @@ int xfrm_bundle_ok(struct xfrm_policy *p
    if (last == first)
    break;

    - last = last->u.next;
    + last = (struct xfrm_dst *)last->u.dst.next;
    last->child_mtu_cached = mtu;
    }

    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-08-07 22:51    [W:0.046 / U:29.000 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site