[IPV6]: Do not virt_to_page() on stack addresses, fixes OOPS.

include/net/if_inet6.h

@@ -175,6 +175,8 @@ struct inet6_dev
 	u8			entropy[8];
 	struct timer_list	regen_timer;
 	struct inet6_ifaddr	*tempaddr_list;
+	__u8			work_eui64[8];
+	__u8			work_digest[16];
 #endif
 
 	struct neigh_parms	*nd_parms;

net/ipv6/addrconf.c

@@ -1109,24 +1109,22 @@ static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
 static int __ipv6_regen_rndid(struct inet6_dev *idev)
 {
 	struct net_device *dev;
-	u8 eui64[8];
-	u8 digest[16];
 	struct scatterlist sg[2];
 
 	sg[0].page = virt_to_page(idev->entropy);
 	sg[0].offset = offset_in_page(idev->entropy);
 	sg[0].length = 8;
-	sg[1].page = virt_to_page(eui64);
-	sg[1].offset = offset_in_page(eui64);
+	sg[1].page = virt_to_page(idev->work_eui64);
+	sg[1].offset = offset_in_page(idev->work_eui64);
 	sg[1].length = 8;
 
 	dev = idev->dev;
 
-	if (ipv6_generate_eui64(eui64, dev)) {
+	if (ipv6_generate_eui64(idev->work_eui64, dev)) {
 		printk(KERN_INFO
 			"__ipv6_regen_rndid(idev=%p): cannot get EUI64 identifier; use random bytes.\n",
 			idev);
-		get_random_bytes(eui64, sizeof(eui64));
+		get_random_bytes(idev->work_eui64, sizeof(idev->work_eui64));
 	}
 regen:
 	spin_lock(&md5_tfm_lock);
@@ -1136,12 +1134,12 @@ static int __ipv6_regen_rndid(struct inet6_dev *idev)
 	}
 	crypto_digest_init(md5_tfm);
 	crypto_digest_update(md5_tfm, sg, 2);
-	crypto_digest_final(md5_tfm, digest);
+	crypto_digest_final(md5_tfm, idev->work_digest);
 	spin_unlock(&md5_tfm_lock);
 
-	memcpy(idev->rndid, &digest[0], 8);
+	memcpy(idev->rndid, &idev->work_digest[0], 8);
 	idev->rndid[0] &= ~0x02;
-	memcpy(idev->entropy, &digest[8], 8);
+	memcpy(idev->entropy, &idev->work_digest[8], 8);
 
 	/*
 	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>: