Commit bcd62075 authored Oct 30, 2006 by James Morris Committed by David S. Miller Oct 30, 2006

[IPV6]: fix lockup via /proc/net/ip6_flowlabel



There's a bug in the seqfile handling for /proc/net/ip6_flowlabel, where,
after finding a flowlabel, the code will loop forever not finding any
further flowlabels, first traversing the rest of the hash bucket then just
looping.

This patch fixes the problem by breaking after the hash bucket has been
traversed.

Note that this bug can cause lockups and oopses, and is trivially invoked
by an unpriveleged user.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a27b58fe

net/ipv6/ip6_flowlabel.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -587,6 +587,8 @@ static struct ip6_flowlabel ip6fl_get_next(struct seq_file seq, struct ip6_flo
		while (!fl) {
		if (++state->bucket <= FL_HASH_MASK)
		fl = fl_ht[state->bucket];
		else
		break;
		}
		return fl;
		}