Re: [PATCH net] ila: Fix tailroom allocation of lwtstate

2016-10-20 Thread Thomas Graf
On 10/20/16 at 11:20am, David Miller wrote: > This patch only applies to net-next, so I've applied it there. > > Please explain how I should handle 'net' and -stable. The presence of ila_params_lwtunnel() in 'net' lead me to believe that 'net' is affected as well. It is not. Applying to 'net-next

Re: [PATCH net] ila: Fix tailroom allocation of lwtstate

2016-10-20 Thread David Miller
From: Thomas Graf Date: Wed, 19 Oct 2016 23:16:39 +0200 > Tailroom is supposed to be of length sizeof(struct ila_lwt) but > sizeof(struct ila_params) is currently allocated. > > This leads to the dst_cache and connected member of ila_lwt being > referenced out of bounds. > > struct ila_lwt { >

[PATCH net] ila: Fix tailroom allocation of lwtstate

2016-10-19 Thread Thomas Graf
Tailroom is supposed to be of length sizeof(struct ila_lwt) but sizeof(struct ila_params) is currently allocated. This leads to the dst_cache and connected member of ila_lwt being referenced out of bounds. struct ila_lwt { struct ila_params p; struct dst_cache dst_cache; u