From: Sven Eckelmann Date: Tue, 3 Nov 2015 09:05:44 +0000 (+0100) Subject: batman-adv: Fix invalid stack access in batadv_dat_select_candidates X-Git-Tag: v3.16.36~56 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=19d8176d7293700f5f98eb0de5187950d486383e;p=thirdparty%2Fkernel%2Fstable.git batman-adv: Fix invalid stack access in batadv_dat_select_candidates commit b7fe3d4f4a65bc675e737d88071300ea9c4bcddd upstream. batadv_dat_select_candidates provides an u32 to batadv_hash_dat but it needs a batadv_dat_entry with at least ip and vid filled in. Fixes: 3e26722bc9f2 ("batman-adv: make the Distributed ARP Table vlan aware") Signed-off-by: Sven Eckelmann Acked-by: Antonio Quartulli Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Ben Hutchings --- diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 28d70b941bb59..8162e3fa76db8 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -534,6 +534,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) int select; batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key; struct batadv_dat_candidate *res; + struct batadv_dat_entry dat; if (!bat_priv->orig_hash) return NULL; @@ -542,7 +543,9 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) if (!res) return NULL; - ip_key = (batadv_dat_addr_t)batadv_hash_dat(&ip_dst, + dat.ip = ip_dst; + dat.vid = 0; + ip_key = (batadv_dat_addr_t)batadv_hash_dat(&dat, BATADV_DAT_ADDR_MAX); batadv_dbg(BATADV_DBG_DAT, bat_priv,