diff mbox

Don't process the icmp packet further when we could not read it

Message ID 20080718111828.GA30595@sven-desktop.lazhur.ath.cx
State Accepted, archived
Headers show

Commit Message

Sven Eckelmann July 18, 2008, 11:18 a.m. UTC
__copy_from_user returns the number of bytes it could not read when it
fails. It makes no sense to process the data further if we don't have it
in a complete form.
access_ok will only check if it may be valid but not if it is definitly valid.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 batman-adv-kernelland/batman-core/device.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

Comments

Simon Wunderlich July 18, 2008, 11:47 a.m. UTC | #1
Hey Sven,

thanks for the patches! Both of them look good so i applied them. By the
way, if anyone knows something like "git am" for svn (applying patches
directly from a mailbox), please tell me. :D

regards,
	Simon

On Fri, Jul 18, 2008 at 01:18:28PM +0200, Sven Eckelmann wrote:
> __copy_from_user returns the number of bytes it could not read when it
> fails. It makes no sense to process the data further if we don't have it
> in a complete form.
> access_ok will only check if it may be valid but not if it is definitly valid.
> 
> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
> ---
>  batman-adv-kernelland/batman-core/device.c |    4 +++-
>  1 files changed, 3 insertions(+), 1 deletions(-)
> 
> diff --git a/batman-adv-kernelland/batman-core/device.c b/batman-adv-kernelland/batman-core/device.c
> index 6608f13..c401634 100644
> --- a/batman-adv-kernelland/batman-core/device.c
> +++ b/batman-adv-kernelland/batman-core/device.c
> @@ -229,7 +229,9 @@ ssize_t bat_device_write(struct file *file, const char __user *buff, size_t len,
>  	if (!access_ok(VERIFY_READ, buff, sizeof(struct icmp_packet)))
>  		return -EFAULT;
>  
> -	__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet));
> +	if (__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet))) {
> +		return -EFAULT;
> +	}
>  
>  	if ((icmp_packet.packet_type == BAT_ICMP) && (icmp_packet.msg_type == ECHO_REQUEST)) {
>  
> -- 
> 1.5.6.3
> 
> 
> _______________________________________________
> B.A.T.M.A.N mailing list
> B.A.T.M.A.N@open-mesh.net
> https://list.open-mesh.net/mm/listinfo/b.a.t.m.a.n
diff mbox

Patch

diff --git a/batman-adv-kernelland/batman-core/device.c b/batman-adv-kernelland/batman-core/device.c
index 6608f13..c401634 100644
--- a/batman-adv-kernelland/batman-core/device.c
+++ b/batman-adv-kernelland/batman-core/device.c
@@ -229,7 +229,9 @@  ssize_t bat_device_write(struct file *file, const char __user *buff, size_t len,
 	if (!access_ok(VERIFY_READ, buff, sizeof(struct icmp_packet)))
 		return -EFAULT;
 
-	__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet));
+	if (__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet))) {
+		return -EFAULT;
+	}
 
 	if ((icmp_packet.packet_type == BAT_ICMP) && (icmp_packet.msg_type == ECHO_REQUEST)) {