From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org,
davem@davemloft.net, rdunlap@xenotime.net,
Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org, akpm@osdl.org, alan@lxorguk.ukuu.org.uk
Subject: [PATCH 03/08] NET: compat ifconf: fix limits
Date: Fri, 24 Mar 2006 20:10:20 -0800 [thread overview]
Message-ID: <20060325041020.GD16955@kroah.com> (raw)
In-Reply-To: <20060325040852.GA16955@kroah.com>
From: Randy Dunlap <rdunlap@xenotime.net>
A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
causes ifconf data to be truncated 1 entry too early when copying it
to userspace. The correct amount of data (length) is returned,
but the final entry is empty (zero, not filled in).
The for-loop 'i' check should use <= to allow the final struct
ifreq32 to be copied. I also used the ifconf-corruption program
in kernel bugzilla #4746 to make sure that this change does not
re-introduce the corruption.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/compat_ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.15.6.orig/fs/compat_ioctl.c
+++ linux-2.6.15.6/fs/compat_ioctl.c
@@ -687,7 +687,7 @@ static int dev_ifconf(unsigned int fd, u
ifr = ifc.ifc_req;
ifr32 = compat_ptr(ifc32.ifcbuf);
for (i = 0, j = 0;
- i + sizeof (struct ifreq32) < ifc32.ifc_len && j < ifc.ifc_len;
+ i + sizeof (struct ifreq32) <= ifc32.ifc_len && j < ifc.ifc_len;
i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) {
if (copy_in_user(ifr32, ifr, sizeof (struct ifreq32)))
return -EFAULT;
next prev parent reply other threads:[~2006-03-25 4:10 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-03-25 4:08 [00/08] 2.6.15.7 -stable review Greg KH
2006-03-25 4:09 ` [PATCH 01/08] IB/srp: Don't send task management commands after target removal Greg KH
2006-03-25 4:10 ` [PATCH 02/08] Netfilter ip_queue: Fix wrong skb->len == nlmsg_len assumption Greg KH
2006-03-25 4:10 ` Greg KH [this message]
2006-03-25 4:10 ` [PATCH 04/08] cramfs mounts provide corrupted content since 2.6.15 Greg KH
2006-03-25 4:11 ` [PATCH 05/08] Kconfig: VIDEO_DECODER must select FW_LOADER Greg KH
2006-03-25 13:21 ` Mauro Carvalho Chehab
2006-03-25 4:11 ` [PATCH 06/08] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242) Greg KH
2006-03-25 4:11 ` [PATCH 07/08] NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated Greg KH
2006-03-25 4:12 ` [PATCH 08/08] Fix ext2 readdir f_pos re-validation logic Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060325041020.GD16955@kroah.com \
--to=gregkh@suse.de \
--cc=akpm@osdl.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=chuckw@quantumlinux.com \
--cc=davem@davemloft.net \
--cc=jmforbes@linuxtx.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rdunlap@xenotime.net \
--cc=stable@kernel.org \
--cc=torvalds@osdl.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.