[B.A.T.M.A.N.] bat_socket_read missing checks

Paul
2011-12-10T14:01:55Z

[-- Attachment #1: Type: text/plain, Size: 153 bytes --]

Writing a icmp_packet_rr and then reading icmp_packet can lead to kernel
memory corruption, if __user *buf is just below TASK_SIZE.

--
Regards,
Paul

[-- Attachment #2: patch.txt --]
[-- Type: text/plain, Size: 622 bytes --]

diff --git a/icmp_socket.c b/icmp_socket.c
index 5bc8649..f6a6536 100644
--- a/icmp_socket.c
+++ b/icmp_socket.c
@@ -136,7 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf,

spin_unlock_bh(&socket_client->lock);

- error = __copy_to_user(buf, &socket_packet->icmp_packet,
+ //queue can contain packets larger than icmp_packet (like icmp_packet_rr),
+ //so we can't rely just on the access_ok above
+ error = copy_to_user(buf, &socket_packet->icmp_packet,
socket_packet->icmp_len);

packet_len = socket_packet->icmp_len;