Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd0bf076 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[XFRM]: Fix crash introduced by struct dst_entry reordering 



XFRM expects xfrm_dst->u.next to be same pointer as dst->next, which
was broken by the dst_entry reordering in commit 1e19e02c~, causing
an oops in xfrm_bundle_ok when walking the bundle upwards.

Kill xfrm_dst->u.next and change the only user to use dst->next instead.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 16751347

include/net/xfrm.h

+0 −1
Original line number Diff line number Diff line
@@ -585,7 +585,6 @@ static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ct 
struct xfrm_dst

{

	union {

		struct xfrm_dst		*next;

		struct dst_entry	dst;

		struct rtable		rt;

		struct rt6_info		rt6;

net/xfrm/xfrm_policy.c

+1 −1
Original line number Diff line number Diff line
@@ -2141,7 +2141,7 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first, 
		if (last == first)

			break;



		last = last->u.next;

		last = (struct xfrm_dst *)last->u.dst.next;

		last->child_mtu_cached = mtu;

	}