diff options
| author | Anton Blanchard <anton@samba.org> | 2011-11-28 01:14:46 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-11-29 03:07:29 +0400 |
| commit | 5cac98dd06bc43a7baab3523184f70fd359e9f35 (patch) | |
| tree | 454623a8d7ba16e94b97d9e3107f0ac4c43164d9 /net/ipv6/ipv6_sockglue.c | |
| parent | c4860ba2e11261a541632ceee8267ca490d9eb98 (diff) | |
| download | linux-5cac98dd06bc43a7baab3523184f70fd359e9f35.tar.xz | |
net: Fix corruption in /proc/*/net/dev_mcast
I just hit this during my testing. Isn't there another bug lurking?
BUG kmalloc-8: Redzone overwritten
INFO: 0xc0000000de9dec48-0xc0000000de9dec4b. First byte 0x0 instead of 0xcc
INFO: Allocated in .__seq_open_private+0x30/0xa0 age=0 cpu=5 pid=3896
.__kmalloc+0x1e0/0x2d0
.__seq_open_private+0x30/0xa0
.seq_open_net+0x60/0xe0
.dev_mc_seq_open+0x4c/0x70
.proc_reg_open+0xd8/0x260
.__dentry_open.clone.11+0x2b8/0x400
.do_last+0xf4/0x950
.path_openat+0xf8/0x480
.do_filp_open+0x48/0xc0
.do_sys_open+0x140/0x250
syscall_exit+0x0/0x40
dev_mc_seq_ops uses dev_seq_start/next/stop but only allocates
sizeof(struct seq_net_private) of private data, whereas it expects
sizeof(struct dev_iter_state):
struct dev_iter_state {
struct seq_net_private p;
unsigned int pos; /* bucket << BUCKET_SPACE + offset */
};
Create dev_seq_open_ops and use it so we don't have to expose
struct dev_iter_state.
[ Problem added by commit f04565ddf52e4 (dev: use name hash for
dev_seq_ops) -Eric ]
Signed-off-by: Anton Blanchard <anton@samba.org>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ipv6_sockglue.c')
0 files changed, 0 insertions, 0 deletions