Terrible bug in ipv4/route.c, mis-sized ip_rt_acct leads to

complete memory corruption.

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 110ba12eb3dfeee1334afe46c1a6184f56b45b7b..83ec3ce97b8e6276df2a0dcb861f977f73bffd35 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2454,7 +2454,7 @@ void __init ip_rt_init(void)
 
 #ifdef CONFIG_NET_CLS_ROUTE
        for (order = 0;
-            (PAGE_SIZE << order) < 256 * sizeof(ip_rt_acct) * NR_CPUS; order++)
+            (PAGE_SIZE << order) < 256 * sizeof(struct ip_rt_acct) * NR_CPUS; order++)
                /* NOTHING */;
        ip_rt_acct = (struct ip_rt_acct *)__get_free_pages(GFP_KERNEL, order);
        if (!ip_rt_acct)