Terrible bug in ipv4/route.c, mis-sized ip_rt_acct leads to

complete memory corruption.

Terrible bug in ipv4/route.c, mis-sized ip_rt_acct leads to
complete memory corruption.
f87c3f42 · Alexey Kuznetsov · David S. Miller · 374e751b · f87c3f42
Commit f87c3f42 authored Mar 19, 2002 by Alexey Kuznetsov Committed by David S. Miller Mar 19, 2002
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

net/ipv4/route.c net/ipv4/route.c +1 -1

No files found.
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2454,7 +2454,7 @@ void __init ip_rt_init(void)

 #ifdef CONFIG_NET_CLS_ROUTE
 	for (order = 0;
-	     (PAGE_SIZE << order) < 256 * sizeof(ip_rt_acct) * NR_CPUS; order++)
+	     (PAGE_SIZE << order) < 256 * sizeof(struct ip_rt_acct) * NR_CPUS; order++)
 		/* NOTHING */;
 	ip_rt_acct = (struct ip_rt_acct *)__get_free_pages(GFP_KERNEL, order);
 	if (!ip_rt_acct)