From patchwork Mon Dec 12 11:31:55 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marek Lindner X-Patchwork-Id: 1485 Return-Path: Received: from nm15.bullet.mail.ukl.yahoo.com (nm15.bullet.mail.ukl.yahoo.com [217.146.183.189]) by open-mesh.org (Postfix) with SMTP id D04F7600854 for ; Mon, 12 Dec 2011 12:33:15 +0100 (CET) Authentication-Results: open-mesh.org; dkim=pass (1024-bit key) header.i=@yahoo.de; dkim-adsp=none Received: from [217.146.183.212] by nm15.bullet.mail.ukl.yahoo.com with NNFMP; 12 Dec 2011 11:33:15 -0000 Received: from [77.238.184.68] by tm5.bullet.mail.ukl.yahoo.com with NNFMP; 12 Dec 2011 11:33:15 -0000 Received: from [127.0.0.1] by smtp137.mail.ukl.yahoo.com with NNFMP; 12 Dec 2011 11:33:15 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.de; s=s1024; t=1323689595; bh=cO4v3wiq9V9/39T6wbCLO85hJRl390MVu1GKCDfWMEQ=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:From:To:Cc:Subject:Date:Message-Id:X-Mailer:In-Reply-To:References; b=NW2mEiGy5NV7XRbiXlpcg9FhZ3tpGAXOA3kUG74q0G2l3Mde8OnKInhkzXQtuYhmJE/hE4NIexpWP5JDOQd2xxRfvNPWm4WWFSo7BjcO+rmygiz3FkKUeNt21gedHzM2x4BkOyn2E1Y0w/T94hMKizSzLk8tIjI0eZ6f0eueqbw= X-Yahoo-Newman-Id: 681264.52820.bm@smtp137.mail.ukl.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: E4eYHFMVM1lwkxGuXboap8HEAVkfZO4hdMJ0nq.QnCco.fg 9_VbKfjYLJCqg_u9ID1a_PpYJzXQxPMgWmuMuUJrCy1ebPTL3AD5zFNgNs8i SSBCL3nxAbyeZjLSm.VS0XwixSONDnVBgcOG6g99.w2Vs0eKd5GVuqHcVW5D hbYt1Mhlp.l2vCyCTwmOI7UWd.N6lH5UKzFIq5ijVaYSAgOesSZ4Krj2JXaG Q7aOLc8rdOin8whhDfUNuhgqhbINF3.tWXW3p5fl3SAyMj7hmaBtMEdgE.Zn bNqkT3Hzt9EJeKkWtrC.9JlLOQGQqn9IcjP08je.uIU1SPlhZ1ktiGu1pS4P TsgYmwz2xUHbLwYuCGhw3JPJo6kSwvGjaYbSMO6flIsAhwLw- X-Yahoo-SMTP: tW.h3tiswBBMXO2coYcbPigGD5Lt6zY_.Zc- Received: from localhost (lindner_marek@210.177.7.38 with plain) by smtp137.mail.ukl.yahoo.com with SMTP; 12 Dec 2011 11:33:14 +0000 GMT From: Marek Lindner To: davem@davemloft.net Date: Mon, 12 Dec 2011 19:31:55 +0800 Message-Id: <1323689516-24427-12-git-send-email-lindner_marek@yahoo.de> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1323689516-24427-1-git-send-email-lindner_marek@yahoo.de> References: <1323689516-24427-1-git-send-email-lindner_marek@yahoo.de> Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, Marek Lindner Subject: [B.A.T.M.A.N.] [PATCH 11/11] batman-adv: Only write requested number of byte to user buffer X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2011 11:33:16 -0000 From: Sven Eckelmann Don't write more than the requested number of bytes of an batman-adv icmp packet to the userspace buffer. Otherwise unrelated userspace memory might get overridden by the kernel. Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner --- net/batman-adv/icmp_socket.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c index 3b04fff..d9c1e7b 100644 --- a/net/batman-adv/icmp_socket.c +++ b/net/batman-adv/icmp_socket.c @@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf, spin_unlock_bh(&socket_client->lock); - error = copy_to_user(buf, &socket_packet->icmp_packet, - socket_packet->icmp_len); + packet_len = min(count, socket_packet->icmp_len); + error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len); - packet_len = socket_packet->icmp_len; kfree(socket_packet); if (error)