Re: [PATCH net] ila: Fix tailroom allocation of lwtstate

2016-10-20 Thread Thomas Graf 
On 10/20/16 at 11:20am, David Miller wrote:
> This patch only applies to net-next, so I've applied it there.
> 
> Please explain how I should handle 'net' and -stable.

The presence of ila_params_lwtunnel() in 'net' lead me to believe that
'net' is affected as well. It is not. Applying to 'net-next' only is
fine.

Re: [PATCH net] ila: Fix tailroom allocation of lwtstate

2016-10-20 Thread David Miller 
From: Thomas Graf 
Date: Wed, 19 Oct 2016 23:16:39 +0200

> Tailroom is supposed to be of length sizeof(struct ila_lwt) but
> sizeof(struct ila_params) is currently allocated.
> 
> This leads to the dst_cache and connected member of ila_lwt being
> referenced out of bounds.
> 
> struct ila_lwt {
>   struct ila_params p;
>   struct dst_cache dst_cache;
>   u32 connected : 1;
> };
> 
> Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
> Signed-off-by: Thomas Graf 
> Acked-by: Daniel Borkmann 
> ---
>  -stable candidate

This patch only applies to net-next, so I've applied it there.

Please explain how I should handle 'net' and -stable.

[PATCH net] ila: Fix tailroom allocation of lwtstate

2016-10-19 Thread Thomas Graf 
Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.

This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.

struct ila_lwt {
struct ila_params p;
struct dst_cache dst_cache;
u32 connected : 1;
};

Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf 
Acked-by: Daniel Borkmann 
---
 -stable candidate

 net/ipv6/ila/ila_lwt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index 9fafba6..c7a39d0 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -122,7 +122,7 @@ static int ila_build_state(struct net_device *dev, struct 
nlattr *nla,
struct ila_lwt *ilwt;
struct ila_params *p;
struct nlattr *tb[ILA_ATTR_MAX + 1];
-   size_t encap_len = sizeof(*p);
+   size_t encap_len = sizeof(*ilwt);
struct lwtunnel_state *newts;
const struct fib6_config *cfg6 = cfg;
struct ila_addr *iaddr;
-- 
2.7.4