lkml.org 
[lkml]   [2013]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 21/56] batman-adv: bat_socket_read missing checks
    Date
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------


    From: Paul Kot <pawlkt@gmail.com>

    commit c00b6856fc642b234895cfabd15b289e76726430 upstream.

    Writing a icmp_packet_rr and then reading icmp_packet can lead to kernel
    memory corruption, if __user *buf is just below TASK_SIZE.

    Signed-off-by: Paul Kot <pawlkt@gmail.com>
    [sven@narfation.org: made it checkpatch clean]
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/batman-adv/icmp_socket.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/net/batman-adv/icmp_socket.c
    +++ b/net/batman-adv/icmp_socket.c
    @@ -136,8 +136,8 @@ static ssize_t bat_socket_read(struct fi

    spin_unlock_bh(&socket_client->lock);

    - error = __copy_to_user(buf, &socket_packet->icmp_packet,
    - socket_packet->icmp_len);
    + error = copy_to_user(buf, &socket_packet->icmp_packet,
    + socket_packet->icmp_len);

    packet_len = socket_packet->icmp_len;
    kfree(socket_packet);



    \
     
     \ /
      Last update: 2013-04-03 02:21    [W:5.083 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site