diff options
| author |   Tom Herbert <tom@herbertland.com> | 2016-11-01 14:55:25 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2016-11-02 15:26:02 -0400 |
| commit | 1913540a1328d70edf8597f6c2248575d9d2ad62 (patch) | |
| tree | 66dee3e9b86d122e3eb0fd40a86e885974b4004e /drivers/net/ethernet/cisco | |
| parent | net: ip, diag -- Adjust raw_abort to use unlocked __udp_disconnect (diff) | |
| download | linux-dev-1913540a1328d70edf8597f6c2248575d9d2ad62.tar.xz linux-dev-1913540a1328d70edf8597f6c2248575d9d2ad62.zip | |
ila: Fix crash caused by rhashtable changes
commit ca26893f05e86 ("rhashtable: Add rhlist interface")
added a field to rhashtable_iter so that length became 56 bytes
and would exceed the size of args in netlink_callback (which is
48 bytes). The netlink diag dump function already has been
allocating a iter structure and storing the pointed to that
in the args of netlink_callback. ila_xlat also uses
rhahstable_iter but is still putting that directly in
the arg block. Now since rhashtable_iter size is increased
we are overwriting beyond the structure. The next field
happens to be cb_mutex pointer in netlink_sock and hence the crash.
Fix is to alloc the rhashtable_iter and save it as pointer
in arg.
Tested:
modprobe ila
./ip ila add loc 3333:0:0:0 loc_match 2222:0:0:1,
./ip ila list # NO crash now
Signed-off-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/cisco')
0 files changed, 0 insertions, 0 deletions