Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 298bf12d authored by Sascha Hlusiak's avatar Sascha Hlusiak Committed by David S. Miller
Browse files

sit: fix off-by-one in ipip6_tunnel_get_prl 



When requesting all prl entries (kprl.addr == INADDR_ANY) and there are
more prl entries than there is space passed from userspace, the existing
code would always copy cmax+1 entries, which is more than can be handled.

This patch makes the kernel copy only exactly cmax entries.

Signed-off-by: default avatarSascha Hlusiak <contact@saschahlusiak.de>
Acked-By: default avatarFred L. Templin <Fred.L.Templin@boeing.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d99927f4

net/ipv6/sit.c

+1 −1
Original line number Diff line number Diff line
@@ -274,7 +274,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t, 


	c = 0;

	for (prl = t->prl; prl; prl = prl->next) {

		if (c > cmax)

		if (c >= cmax)

			break;

		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)

			continue;