diff options
author | Patrick McHardy <kaber@trash.net> | 2007-07-18 04:55:52 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2007-07-18 04:55:52 -0400 |
commit | bd0bf0765ea1fba80d7085e1f0375ec045631dc1 (patch) | |
tree | 7a637d217e6f090f3eebe127a11fcbfaabc1c3cd | |
parent | 16751347a060a10c09b11593bb179fd5b0240c04 (diff) |
[XFRM]: Fix crash introduced by struct dst_entry reordering
XFRM expects xfrm_dst->u.next to be same pointer as dst->next, which
was broken by the dst_entry reordering in commit 1e19e02c~, causing
an oops in xfrm_bundle_ok when walking the bundle upwards.
Kill xfrm_dst->u.next and change the only user to use dst->next instead.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | include/net/xfrm.h | 1 | ||||
-rw-r--r-- | net/xfrm/xfrm_policy.c | 2 |
2 files changed, 1 insertions, 2 deletions
diff --git a/include/net/xfrm.h b/include/net/xfrm.h index ae959e950174..a5f80bfbaaa4 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h | |||
@@ -585,7 +585,6 @@ static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ct | |||
585 | struct xfrm_dst | 585 | struct xfrm_dst |
586 | { | 586 | { |
587 | union { | 587 | union { |
588 | struct xfrm_dst *next; | ||
589 | struct dst_entry dst; | 588 | struct dst_entry dst; |
590 | struct rtable rt; | 589 | struct rtable rt; |
591 | struct rt6_info rt6; | 590 | struct rt6_info rt6; |
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 157bfbd250ba..b48f06fc9fd9 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c | |||
@@ -2141,7 +2141,7 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first, | |||
2141 | if (last == first) | 2141 | if (last == first) |
2142 | break; | 2142 | break; |
2143 | 2143 | ||
2144 | last = last->u.next; | 2144 | last = (struct xfrm_dst *)last->u.dst.next; |
2145 | last->child_mtu_cached = mtu; | 2145 | last->child_mtu_cached = mtu; |
2146 | } | 2146 | } |
2147 | 2147 | ||