Skip to content
Permalink
Browse files Browse the repository at this point in the history
batman-adv: Only write requested number of byte to user buffer
Don't write more than the requested number of bytes of an batman-adv icmp
packet to the userspace buffer. Otherwise unrelated userspace memory might get
overridden by the kernel.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
  • Loading branch information
ecsv authored and Marek Lindner committed Dec 12, 2011
1 parent d18eb45 commit b5a1eee
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions net/batman-adv/icmp_socket.c
Expand Up @@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf,

spin_unlock_bh(&socket_client->lock);

error = copy_to_user(buf, &socket_packet->icmp_packet,
socket_packet->icmp_len);
packet_len = min(count, socket_packet->icmp_len);
error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);

packet_len = socket_packet->icmp_len;
kfree(socket_packet);

if (error)
Expand Down

0 comments on commit b5a1eee

Please sign in to comment.