Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5a1eeef authored by Sven Eckelmann's avatar Sven Eckelmann Committed by Marek Lindner
Browse files

batman-adv: Only write requested number of byte to user buffer 



Don't write more than the requested number of bytes of an batman-adv icmp
packet to the userspace buffer. Otherwise unrelated userspace memory might get
overridden by the kernel.

Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
parent d18eb453

net/batman-adv/icmp_socket.c

+2 −3
Original line number Diff line number Diff line
@@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf, 


	spin_unlock_bh(&socket_client->lock);



	error = copy_to_user(buf, &socket_packet->icmp_packet,

			     socket_packet->icmp_len);

	packet_len = min(count, socket_packet->icmp_len);

	error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);



	packet_len = socket_packet->icmp_len;

	kfree(socket_packet);



	if (error)