diff options
| author | Randy Dunlap <rdunlap@xenotime.net> | 2006-03-08 17:43:17 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-03-27 23:00:22 -0800 |
| commit | 8a3a2a3299081913c22f5d0e1ce893b781efe942 (patch) | |
| tree | dc92dfc721eeede93c253c78b9b29ece52fa12a7 | |
| parent | b7bec2ba8b776bc3d122375832105c792a1eda3b (diff) | |
[PATCH] compat ifconf: fix limits
A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
causes ifconf data to be truncated 1 entry too early when copying it
to userspace. The correct amount of data (length) is returned,
but the final entry is empty (zero, not filled in).
The for-loop 'i' check should use <= to allow the final struct
ifreq32 to be copied. I also used the ifconf-corruption program
in kernel bugzilla #4746 to make sure that this change does not
re-introduce the corruption.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | fs/compat_ioctl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c index 43a2508ac696..8b19b33b4071 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c @@ -687,7 +687,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg) ifr = ifc.ifc_req; ifr32 = compat_ptr(ifc32.ifcbuf); for (i = 0, j = 0; - i + sizeof (struct ifreq32) < ifc32.ifc_len && j < ifc.ifc_len; + i + sizeof (struct ifreq32) <= ifc32.ifc_len && j < ifc.ifc_len; i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) { if (copy_in_user(ifr32, ifr, sizeof (struct ifreq32))) return -EFAULT; |