[PATCH net] ila: Fix tailroom allocation of lwtstate

[PATCH net] ila: Fix tailroom allocation of lwtstate

[Thomas Graf]

Tailroom is supposed to be of length sizeof(struct ila_lwt) but
sizeof(struct ila_params) is currently allocated.

This leads to the dst_cache and connected member of ila_lwt being
referenced out of bounds.

struct ila_lwt {
	struct ila_params p;
	struct dst_cache dst_cache;
	u32 connected : 1;
};

Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
---
 -stable candidate

 net/ipv6/ila/ila_lwt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index 9fafba6..c7a39d0 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -122,7 +122,7 @@ static int ila_build_state(struct net_device *dev, struct nlattr *nla,
 	struct ila_lwt *ilwt;
 	struct ila_params *p;
 	struct nlattr *tb[ILA_ATTR_MAX + 1];
-	size_t encap_len = sizeof(*p);
+	size_t encap_len = sizeof(*ilwt);
 	struct lwtunnel_state *newts;
 	const struct fib6_config *cfg6 = cfg;
 	struct ila_addr *iaddr;
-- 
2.7.4

Re: [PATCH net] ila: Fix tailroom allocation of lwtstate

[David Miller]

From: Thomas Graf <tgraf@suug.ch>
Date: Wed, 19 Oct 2016 23:16:39 +0200

> Tailroom is supposed to be of length sizeof(struct ila_lwt) but
> sizeof(struct ila_params) is currently allocated.
> 
> This leads to the dst_cache and connected member of ila_lwt being
> referenced out of bounds.
> 
> struct ila_lwt {
> 	struct ila_params p;
> 	struct dst_cache dst_cache;
> 	u32 connected : 1;
> };
> 
> Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module")
> Signed-off-by: Thomas Graf <tgraf@suug.ch>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
>  -stable candidate

This patch only applies to net-next, so I've applied it there.

Please explain how I should handle 'net' and -stable.

Re: [PATCH net] ila: Fix tailroom allocation of lwtstate

[Thomas Graf]

On 10/20/16 at 11:20am, David Miller wrote:
> This patch only applies to net-next, so I've applied it there.
> 
> Please explain how I should handle 'net' and -stable.

The presence of ila_params_lwtunnel() in 'net' lead me to believe that
'net' is affected as well. It is not. Applying to 'net-next' only is
fine.