• Anton Blanchard's avatar
    net: Fix corruption in /proc/*/net/dev_mcast · 5cac98dd
    Anton Blanchard authored
    I just hit this during my testing. Isn't there another bug lurking?
    
    BUG kmalloc-8: Redzone overwritten
    
    INFO: 0xc0000000de9dec48-0xc0000000de9dec4b. First byte 0x0 instead of 0xcc
    INFO: Allocated in .__seq_open_private+0x30/0xa0 age=0 cpu=5 pid=3896
    	.__kmalloc+0x1e0/0x2d0
    	.__seq_open_private+0x30/0xa0
    	.seq_open_net+0x60/0xe0
    	.dev_mc_seq_open+0x4c/0x70
    	.proc_reg_open+0xd8/0x260
    	.__dentry_open.clone.11+0x2b8/0x400
    	.do_last+0xf4/0x950
    	.path_openat+0xf8/0x480
    	.do_filp_open+0x48/0xc0
    	.do_sys_open+0x140/0x250
    	syscall_exit+0x0/0x40
    
    dev_mc_seq_ops uses dev_seq_start/next/stop but only allocates
    sizeof(struct seq_net_private) of private data, whereas it expects
    sizeof(struct dev_iter_state):
    
    struct dev_iter_state {
    	struct seq_net_private p;
    	unsigned int pos; /* bucket << BUCKET_SPACE + offset */
    };
    
    Create dev_seq_open_ops and use it so we don't have to expose
    struct dev_iter_state.
    
    [ Problem added by commit f04565dd (dev: use name hash for
      dev_seq_ops) -Eric ]
    Signed-off-by: default avatarAnton Blanchard <anton@samba.org>
    Acked-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5cac98dd
dev_addr_lists.c 17.1 KB