diff options
| author |   Johannes Berg <johannes.berg@intel.com> | 2018-09-13 14:40:55 +0200 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-09-13 16:01:06 -0700 |
| commit | 1cebf8f143c21eb422cd0f4e27ab2ae366eb4d04 (patch) | |
| tree | 87b8677eb03c7a7faf5033ef1ee1b4576fcb9cb1 /net/sched/act_sample.c | |
| parent | gso_segment: Reset skb->mac_len after modifying network header (diff) | |
| download | linux-dev-1cebf8f143c21eb422cd0f4e27ab2ae366eb4d04.tar.xz linux-dev-1cebf8f143c21eb422cd0f4e27ab2ae366eb4d04.zip | |
socket: fix struct ifreq size in compat ioctl
As reported by Reobert O'Callahan, since Viro's commit to kill
dev_ifsioc() we attempt to copy too much data in compat mode,
which may lead to EFAULT when the 32-bit version of struct ifreq
sits at/near the end of a page boundary, and the next page isn't
mapped.
Fix this by passing the approprate compat/non-compat size to copy
and using that, as before the dev_ifsioc() removal. This works
because only the embedded "struct ifmap" has different size, and
this is only used in SIOCGIFMAP/SIOCSIFMAP which has a different
handler. All other parts of the union are naturally compatible.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=199469.
Fixes: bf4405737f9f ("kill dev_ifsioc()")
Reported-by: Robert O'Callahan <robert@ocallahan.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions