From bad947f54c52659d507f2407b903a9dbdaba36b7 Mon Sep 17 00:00:00 2001 From: Laine Stump Date: Tue, 17 Jan 2017 10:47:34 -0500 Subject: [PATCH] sriov: fix crash in rtnl_link_sriov_parse_vflist vf_vlan_info was incorrectly indexed with "len" (the length in bytes of the entire vfinfo_list rather than list_len (the index of the current end of the vf_vlan_info array) https://github.com/thom311/libnl/issues/126 http://lists.infradead.org/pipermail/libnl/2017-January/002270.html Fixes: 5d6e43ebef12deadf31fccfa46c0b34892675d36 Signed-off-by: Thomas Haller --- lib/route/link/sriov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/route/link/sriov.c b/lib/route/link/sriov.c index acabf6742c..3721ae83d8 100644 --- a/lib/route/link/sriov.c +++ b/lib/route/link/sriov.c @@ -568,7 +568,7 @@ int rtnl_link_sriov_parse_vflist(struct rtnl_link *link, struct nlattr **tb) { list_len = 0; nla_for_each_nested(nla_list, t[IFLA_VF_VLAN_LIST], list_rem) { - vf_vlan_info[len] = nla_data(nla_list); + vf_vlan_info[list_len] = nla_data(nla_list); list_len++; }