summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorSven Eckelmann <sven@narfation.org>2013-03-19 12:36:50 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-04-05 10:16:38 -0700
commit2e8e2c7847cc17a8135ad17869f5ba37207e2f89 (patch)
treeeb91adc8a58bbf06a65824f989b23f606ff8e249 /net
parent19c0a0f3f768551fc708ebc9b2345e5dcc248d3a (diff)
batman-adv: Only write requested number of byte to user buffer
commit b5a1eeef04cc7859f34dec9b72ea1b28e4aba07c upstream. Don't write more than the requested number of bytes of an batman-adv icmp packet to the userspace buffer. Otherwise unrelated userspace memory might get overridden by the kernel. Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/batman-adv/icmp_socket.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 88c310aacc40..ad7d8b289abd 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf,
spin_unlock_bh(&socket_client->lock);
- error = copy_to_user(buf, &socket_packet->icmp_packet,
- socket_packet->icmp_len);
+ packet_len = min(count, socket_packet->icmp_len);
+ error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);
- packet_len = socket_packet->icmp_len;
kfree(socket_packet);
if (error)