ila: Fix crash caused by rhashtable changes
commit ca26893f05
("rhashtable: Add rhlist interface")
added a field to rhashtable_iter so that length became 56 bytes
and would exceed the size of args in netlink_callback (which is
48 bytes). The netlink diag dump function already has been
allocating a iter structure and storing the pointed to that
in the args of netlink_callback. ila_xlat also uses
rhahstable_iter but is still putting that directly in
the arg block. Now since rhashtable_iter size is increased
we are overwriting beyond the structure. The next field
happens to be cb_mutex pointer in netlink_sock and hence the crash.
Fix is to alloc the rhashtable_iter and save it as pointer
in arg.
Tested:
modprobe ila
./ip ila add loc 3333:0:0:0 loc_match 2222:0:0:1,
./ip ila list # NO crash now
Signed-off-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
3de864f8c9
commit
1913540a13
|
@ -474,7 +474,15 @@ static int ila_nl_dump_start(struct netlink_callback *cb)
|
|||
{
|
||||
struct net *net = sock_net(cb->skb->sk);
|
||||
struct ila_net *ilan = net_generic(net, ila_net_id);
|
||||
struct ila_dump_iter *iter = (struct ila_dump_iter *)cb->args;
|
||||
struct ila_dump_iter *iter = (struct ila_dump_iter *)cb->args[0];
|
||||
|
||||
if (!iter) {
|
||||
iter = kmalloc(sizeof(*iter), GFP_KERNEL);
|
||||
if (!iter)
|
||||
return -ENOMEM;
|
||||
|
||||
cb->args[0] = (long)iter;
|
||||
}
|
||||
|
||||
return rhashtable_walk_init(&ilan->rhash_table, &iter->rhiter,
|
||||
GFP_KERNEL);
|
||||
|
@ -482,16 +490,18 @@ static int ila_nl_dump_start(struct netlink_callback *cb)
|
|||
|
||||
static int ila_nl_dump_done(struct netlink_callback *cb)
|
||||
{
|
||||
struct ila_dump_iter *iter = (struct ila_dump_iter *)cb->args;
|
||||
struct ila_dump_iter *iter = (struct ila_dump_iter *)cb->args[0];
|
||||
|
||||
rhashtable_walk_exit(&iter->rhiter);
|
||||
|
||||
kfree(iter);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int ila_nl_dump(struct sk_buff *skb, struct netlink_callback *cb)
|
||||
{
|
||||
struct ila_dump_iter *iter = (struct ila_dump_iter *)cb->args;
|
||||
struct ila_dump_iter *iter = (struct ila_dump_iter *)cb->args[0];
|
||||
struct rhashtable_iter *rhiter = &iter->rhiter;
|
||||
struct ila_map *ila;
|
||||
int ret;
|
||||
|
|
Loading…
Reference in a new issue