From patchwork Mon Dec 12 11:31:55 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marek Lindner X-Patchwork-Id: 130721 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 097DB1007D1 for ; Mon, 12 Dec 2011 22:33:22 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752710Ab1LLLdR (ORCPT ); Mon, 12 Dec 2011 06:33:17 -0500 Received: from nm15.bullet.mail.ukl.yahoo.com ([217.146.183.189]:34901 "HELO nm15.bullet.mail.ukl.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1752546Ab1LLLdQ (ORCPT ); Mon, 12 Dec 2011 06:33:16 -0500 Received: from [217.146.183.212] by nm15.bullet.mail.ukl.yahoo.com with NNFMP; 12 Dec 2011 11:33:15 -0000 Received: from [77.238.184.68] by tm5.bullet.mail.ukl.yahoo.com with NNFMP; 12 Dec 2011 11:33:15 -0000 Received: from [127.0.0.1] by smtp137.mail.ukl.yahoo.com with NNFMP; 12 Dec 2011 11:33:15 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.de; s=s1024; t=1323689595; bh=cO4v3wiq9V9/39T6wbCLO85hJRl390MVu1GKCDfWMEQ=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:From:To:Cc:Subject:Date:Message-Id:X-Mailer:In-Reply-To:References; b=NW2mEiGy5NV7XRbiXlpcg9FhZ3tpGAXOA3kUG74q0G2l3Mde8OnKInhkzXQtuYhmJE/hE4NIexpWP5JDOQd2xxRfvNPWm4WWFSo7BjcO+rmygiz3FkKUeNt21gedHzM2x4BkOyn2E1Y0w/T94hMKizSzLk8tIjI0eZ6f0eueqbw= X-Yahoo-Newman-Id: 681264.52820.bm@smtp137.mail.ukl.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: E4eYHFMVM1lwkxGuXboap8HEAVkfZO4hdMJ0nq.QnCco.fg 9_VbKfjYLJCqg_u9ID1a_PpYJzXQxPMgWmuMuUJrCy1ebPTL3AD5zFNgNs8i SSBCL3nxAbyeZjLSm.VS0XwixSONDnVBgcOG6g99.w2Vs0eKd5GVuqHcVW5D hbYt1Mhlp.l2vCyCTwmOI7UWd.N6lH5UKzFIq5ijVaYSAgOesSZ4Krj2JXaG Q7aOLc8rdOin8whhDfUNuhgqhbINF3.tWXW3p5fl3SAyMj7hmaBtMEdgE.Zn bNqkT3Hzt9EJeKkWtrC.9JlLOQGQqn9IcjP08je.uIU1SPlhZ1ktiGu1pS4P TsgYmwz2xUHbLwYuCGhw3JPJo6kSwvGjaYbSMO6flIsAhwLw- X-Yahoo-SMTP: tW.h3tiswBBMXO2coYcbPigGD5Lt6zY_.Zc- Received: from localhost (lindner_marek@210.177.7.38 with plain) by smtp137.mail.ukl.yahoo.com with SMTP; 12 Dec 2011 11:33:14 +0000 GMT From: Marek Lindner To: davem@davemloft.net Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, Sven Eckelmann , Marek Lindner Subject: [PATCH 11/11] batman-adv: Only write requested number of byte to user buffer Date: Mon, 12 Dec 2011 19:31:55 +0800 Message-Id: <1323689516-24427-12-git-send-email-lindner_marek@yahoo.de> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1323689516-24427-1-git-send-email-lindner_marek@yahoo.de> References: <1323689516-24427-1-git-send-email-lindner_marek@yahoo.de> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Sven Eckelmann Don't write more than the requested number of bytes of an batman-adv icmp packet to the userspace buffer. Otherwise unrelated userspace memory might get overridden by the kernel. Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner --- net/batman-adv/icmp_socket.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c index 3b04fff..d9c1e7b 100644 --- a/net/batman-adv/icmp_socket.c +++ b/net/batman-adv/icmp_socket.c @@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf, spin_unlock_bh(&socket_client->lock); - error = copy_to_user(buf, &socket_packet->icmp_packet, - socket_packet->icmp_len); + packet_len = min(count, socket_packet->icmp_len); + error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len); - packet_len = socket_packet->icmp_len; kfree(socket_packet); if (error)