From efe5ebcc317c7e734e5c7b5d3e217d18916aa12c Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Sun, 26 Oct 2003 08:56:29 -0800 Subject: [PATCH] [IPV6]: Do not virt_to_page() on stack addresses, fixes OOPS. --- include/net/if_inet6.h | 2 ++ net/ipv6/addrconf.c | 16 +++++++--------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h index 1cba818bc6e63..6dd6ebda5e6f3 100644 --- a/include/net/if_inet6.h +++ b/include/net/if_inet6.h @@ -175,6 +175,8 @@ struct inet6_dev u8 entropy[8]; struct timer_list regen_timer; struct inet6_ifaddr *tempaddr_list; + __u8 work_eui64[8]; + __u8 work_digest[16]; #endif struct neigh_parms *nd_parms; diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index be97eee5f10aa..e1f2593b19f03 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1109,24 +1109,22 @@ static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev) static int __ipv6_regen_rndid(struct inet6_dev *idev) { struct net_device *dev; - u8 eui64[8]; - u8 digest[16]; struct scatterlist sg[2]; sg[0].page = virt_to_page(idev->entropy); sg[0].offset = offset_in_page(idev->entropy); sg[0].length = 8; - sg[1].page = virt_to_page(eui64); - sg[1].offset = offset_in_page(eui64); + sg[1].page = virt_to_page(idev->work_eui64); + sg[1].offset = offset_in_page(idev->work_eui64); sg[1].length = 8; dev = idev->dev; - if (ipv6_generate_eui64(eui64, dev)) { + if (ipv6_generate_eui64(idev->work_eui64, dev)) { printk(KERN_INFO "__ipv6_regen_rndid(idev=%p): cannot get EUI64 identifier; use random bytes.\n", idev); - get_random_bytes(eui64, sizeof(eui64)); + get_random_bytes(idev->work_eui64, sizeof(idev->work_eui64)); } regen: spin_lock(&md5_tfm_lock); @@ -1136,12 +1134,12 @@ regen: } crypto_digest_init(md5_tfm); crypto_digest_update(md5_tfm, sg, 2); - crypto_digest_final(md5_tfm, digest); + crypto_digest_final(md5_tfm, idev->work_digest); spin_unlock(&md5_tfm_lock); - memcpy(idev->rndid, &digest[0], 8); + memcpy(idev->rndid, &idev->work_digest[0], 8); idev->rndid[0] &= ~0x02; - memcpy(idev->entropy, &digest[8], 8); + memcpy(idev->entropy, &idev->work_digest[8], 8); /* * : -- 2.53.0