Messages in this thread Patch in this message |  | | | Date | Tue, 15 Jun 2004 15:55:41 -0700 | | From | Chris Wright <> | | Subject | [PATCH] ethtool_get_regs copy right number of bytes to user |
| |
If regs.len is smaller than reglen it's possible to copy more bytes out than the user asked for.
Signed-off-by: Chris Wright <chrisw@osdl.org>
===== net/core/ethtool.c 1.14 vs edited ===== --- 1.14/net/core/ethtool.c 2004-06-02 14:54:28 -07:00 +++ edited/net/core/ethtool.c 2004-06-13 12:59:15 -07:00 @@ -157,7 +157,7 @@ if (copy_to_user(useraddr, ®s, sizeof(regs))) goto out; useraddr += offsetof(struct ethtool_regs, data); - if (copy_to_user(useraddr, regbuf, reglen)) + if (copy_to_user(useraddr, regbuf, regs.len)) goto out; ret = 0; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |