Commit 5a3b886c authored Jul 06, 2017 by Matthias Rosenfelder Committed by David S. Miller Jul 06, 2017

TLS: Fix length check in do_tls_getsockopt_tx()



copy_to_user() copies the struct the pointer is pointing to, but the
length check compares against sizeof(pointer) and not sizeof(struct).
On 32-bit the size is probably the same, so it might have worked
accidentally.

Signed-off-by: Matthias Rosenfelder <mrosenfelder.lkml@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent e8f37d57

net/tls/tls_main.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -272,7 +272,7 @@ static int do_tls_getsockopt_tx(struct sock sk, char __user optval,
	goto out;		goto out;
	}		}

	if (len == sizeof(crypto_info)) {		if (len == sizeof(*crypto_info)) {
	if (copy_to_user(optval, crypto_info, sizeof(*crypto_info)))		if (copy_to_user(optval, crypto_info, sizeof(*crypto_info)))
	rc = -EFAULT;		rc = -EFAULT;
	goto out;		goto out;