Commit d231b109 authored by Jamal Hadi Salim's avatar Jamal Hadi Salim Committed by Hideaki Yoshifuji

[NET]: Fix OOPSes with RSVP.

parent b7911d4a
...@@ -515,7 +515,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base, ...@@ -515,7 +515,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
for (sp = &data->ht[h1]; (s=*sp) != NULL; sp = &s->next) { for (sp = &data->ht[h1]; (s=*sp) != NULL; sp = &s->next) {
if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] && if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
pinfo->protocol == s->protocol && pinfo && pinfo->protocol == s->protocol &&
memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0
#if RSVP_DST_LEN == 4 #if RSVP_DST_LEN == 4
&& dst[0] == s->dst[0] && dst[0] == s->dst[0]
...@@ -557,9 +557,12 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base, ...@@ -557,9 +557,12 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
goto errout; goto errout;
memset(s, 0, sizeof(*s)); memset(s, 0, sizeof(*s));
memcpy(s->dst, dst, sizeof(s->dst)); memcpy(s->dst, dst, sizeof(s->dst));
s->dpi = pinfo->dpi;
s->protocol = pinfo->protocol; if (pinfo) {
s->tunnelid = pinfo->tunnelid; s->dpi = pinfo->dpi;
s->protocol = pinfo->protocol;
s->tunnelid = pinfo->tunnelid;
}
for (sp = &data->ht[h1]; *sp; sp = &(*sp)->next) { for (sp = &data->ht[h1]; *sp; sp = &(*sp)->next) {
if (((*sp)->dpi.mask&s->dpi.mask) != s->dpi.mask) if (((*sp)->dpi.mask&s->dpi.mask) != s->dpi.mask)
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment