Don't process the icmp packet further when we could not read it
Commit Message
__copy_from_user returns the number of bytes it could not read when it
fails. It makes no sense to process the data further if we don't have it
in a complete form.
access_ok will only check if it may be valid but not if it is definitly valid.
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
batman-adv-kernelland/batman-core/device.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
Comments
Hey Sven,
thanks for the patches! Both of them look good so i applied them. By the
way, if anyone knows something like "git am" for svn (applying patches
directly from a mailbox), please tell me. :D
regards,
Simon
On Fri, Jul 18, 2008 at 01:18:28PM +0200, Sven Eckelmann wrote:
> __copy_from_user returns the number of bytes it could not read when it
> fails. It makes no sense to process the data further if we don't have it
> in a complete form.
> access_ok will only check if it may be valid but not if it is definitly valid.
>
> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
> ---
> batman-adv-kernelland/batman-core/device.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/batman-adv-kernelland/batman-core/device.c b/batman-adv-kernelland/batman-core/device.c
> index 6608f13..c401634 100644
> --- a/batman-adv-kernelland/batman-core/device.c
> +++ b/batman-adv-kernelland/batman-core/device.c
> @@ -229,7 +229,9 @@ ssize_t bat_device_write(struct file *file, const char __user *buff, size_t len,
> if (!access_ok(VERIFY_READ, buff, sizeof(struct icmp_packet)))
> return -EFAULT;
>
> - __copy_from_user(&icmp_packet, buff, sizeof(icmp_packet));
> + if (__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet))) {
> + return -EFAULT;
> + }
>
> if ((icmp_packet.packet_type == BAT_ICMP) && (icmp_packet.msg_type == ECHO_REQUEST)) {
>
> --
> 1.5.6.3
>
>
> _______________________________________________
> B.A.T.M.A.N mailing list
> B.A.T.M.A.N@open-mesh.net
> https://list.open-mesh.net/mm/listinfo/b.a.t.m.a.n
@@ -229,7 +229,9 @@ ssize_t bat_device_write(struct file *file, const char __user *buff, size_t len,
if (!access_ok(VERIFY_READ, buff, sizeof(struct icmp_packet)))
return -EFAULT;
- __copy_from_user(&icmp_packet, buff, sizeof(icmp_packet));
+ if (__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet))) {
+ return -EFAULT;
+ }
if ((icmp_packet.packet_type == BAT_ICMP) && (icmp_packet.msg_type == ECHO_REQUEST)) {