Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c00b6856 authored by Paul Kot's avatar Paul Kot Committed by Marek Lindner
Browse files

batman-adv: bat_socket_read missing checks 



Writing a icmp_packet_rr and then reading icmp_packet can lead to kernel
memory corruption, if __user *buf is just below TASK_SIZE.

Signed-off-by: default avatarPaul Kot <pawlkt@gmail.com>
[sven@narfation.org: made it checkpatch clean]
Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
parent 69497c17

net/batman-adv/icmp_socket.c

+2 −2
Original line number Diff line number Diff line
@@ -136,7 +136,7 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf, 


	spin_unlock_bh(&socket_client->lock);



	error = __copy_to_user(buf, &socket_packet->icmp_packet,

	error = copy_to_user(buf, &socket_packet->icmp_packet,

			     socket_packet->icmp_len);



	packet_len = socket_packet->icmp_len;