From: Patrick McHardy <kaber@trash.net>
Date: Wed, 17 Mar 2010 06:04:14 +0000 (+0000)
Subject: net: ipmr/ip6mr: fix potential out-of-bounds vif_table access
X-Git-Tag: v2.6.34-rc3~84^2~11
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a50436f2cd6e85794f7e1aad795ca8302177b896;p=pandora-kernel.git

net: ipmr/ip6mr: fix potential out-of-bounds vif_table access

mfc_parent of cache entries is used to index into the vif_table and is
initialised from mfcctl->mfcc_parent. This can take values of to 2^16-1,
while the vif_table has only MAXVIFS (32) entries. The same problem
affects ip6mr.

Refuse invalid values to fix a potential out-of-bounds access. Unlike
the other validity checks, this is checked in ipmr_mfc_add() instead of
the setsockopt handler since its unused in the delete path and might be
uninitialized.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed