summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorRandy Dunlap <rdunlap@xenotime.net>2006-03-09 03:46:08 +0300
committerDavid S. Miller <davem@davemloft.net>2006-03-09 03:46:08 +0300
commit1efa3c05f8640c37ba89d54dfaa18504d21986ce (patch)
treec777fd8a5fc44492971ac51f8299c4cbfb52f175 /fs
parent2ec5e3a867d63d04932e11c6097f63760d9be3fe (diff)
downloadlinux-1efa3c05f8640c37ba89d54dfaa18504d21986ce.tar.xz
[NET] compat ifconf: fix limits
A recent change to compat. dev_ifconf() in fs/compat_ioctl.c causes ifconf data to be truncated 1 entry too early when copying it to userspace. The correct amount of data (length) is returned, but the final entry is empty (zero, not filled in). The for-loop 'i' check should use <= to allow the final struct ifreq32 to be copied. I also used the ifconf-corruption program in kernel bugzilla #4746 to make sure that this change does not re-introduce the corruption. Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'fs')
-rw-r--r--fs/compat_ioctl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 537ac70edfe5..c666769a875d 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -446,7 +446,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
ifr = ifc.ifc_req;
ifr32 = compat_ptr(ifc32.ifcbuf);
for (i = 0, j = 0;
- i + sizeof (struct ifreq32) < ifc32.ifc_len && j < ifc.ifc_len;
+ i + sizeof (struct ifreq32) <= ifc32.ifc_len && j < ifc.ifc_len;
i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) {
if (copy_in_user(ifr32, ifr, sizeof (struct ifreq32)))
return -EFAULT;