hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[NETFILTER]: x_tables: don't use __copy_{from,to}_user on unchecked memory in compat layer 

Noticed by Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2006-05-03 23:20:27 -07:00 committed by David S. Miller
parent 7582e9d17e
commit 7800007c1e
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/ipv4/netfilter/ip_tables.c
View File

@ -1441,7 +1441,7 @@ static int compat_copy_entry_to_user(struct ipt_entry *e,
ret = -EFAULT; ret = -EFAULT;
origsize = *size; origsize = *size;
ce = (struct compat_ipt_entry __user *)*dstptr; ce = (struct compat_ipt_entry __user *)*dstptr;
if (__copy_to_user(ce, e, sizeof(struct ipt_entry))) if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
goto out; goto out;
*dstptr += sizeof(struct compat_ipt_entry); *dstptr += sizeof(struct compat_ipt_entry);
@ -1459,9 +1459,9 @@ static int compat_copy_entry_to_user(struct ipt_entry *e,
goto out; goto out;
ret = -EFAULT; ret = -EFAULT;
next_offset = e->next_offset - (origsize - *size); next_offset = e->next_offset - (origsize - *size);
if (__put_user(target_offset, &ce->target_offset)) if (put_user(target_offset, &ce->target_offset))
goto out; goto out;
if (__put_user(next_offset, &ce->next_offset)) if (put_user(next_offset, &ce->next_offset))
goto out; goto out;
return 0; return 0;
out: out:

4
net/netfilter/x_tables.c
View File

@ -289,7 +289,7 @@ int xt_compat_match(void *match, void **dstptr, int *size, int convert)
case COMPAT_TO_USER: case COMPAT_TO_USER:
pm = (struct xt_entry_match *)match; pm = (struct xt_entry_match *)match;
msize = pm->u.user.match_size; msize = pm->u.user.match_size;
if (__copy_to_user(*dstptr, pm, msize)) { if (copy_to_user(*dstptr, pm, msize)) {
ret = -EFAULT; ret = -EFAULT;
break; break;
} }
@ -366,7 +366,7 @@ int xt_compat_target(void *target, void **dstptr, int *size, int convert)
case COMPAT_TO_USER: case COMPAT_TO_USER:
pt = (struct xt_entry_target *)target; pt = (struct xt_entry_target *)target;
tsize = pt->u.user.target_size; tsize = pt->u.user.target_size;
if (__copy_to_user(*dstptr, pt, tsize)) { if (copy_to_user(*dstptr, pt, tsize)) {
ret = -EFAULT; ret = -EFAULT;
break; break;
} }