Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 7800007c1e2d42cd4120b87b0ba3f3480f17f30a

Authored by Patrick McHardy
Committed by David S. Miller
1 parent 7582e9d17e
Exists in master and in 39 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

[NETFILTER]: x_tables: don't use __copy_{from,to}_user on unchecked memory in compat layer 

Noticed by Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 2 changed files with 5 additions and 5 deletions Side-by-side Diff

net/ipv4/netfilter/ip_tables.c
Diff comments   View file @ 7800007
... ... @@ -1441,7 +1441,7 @@
1441 1441 ret = -EFAULT;
1442 1442 origsize = *size;
1443 1443 ce = (struct compat_ipt_entry __user *)*dstptr;
1444   - if (__copy_to_user(ce, e, sizeof(struct ipt_entry)))
  1444 + if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
1445 1445 goto out;
1446 1446  
1447 1447 *dstptr += sizeof(struct compat_ipt_entry);
1448 1448  
... ... @@ -1459,9 +1459,9 @@
1459 1459 goto out;
1460 1460 ret = -EFAULT;
1461 1461 next_offset = e->next_offset - (origsize - *size);
1462   - if (__put_user(target_offset, &ce->target_offset))
  1462 + if (put_user(target_offset, &ce->target_offset))
1463 1463 goto out;
1464   - if (__put_user(next_offset, &ce->next_offset))
  1464 + if (put_user(next_offset, &ce->next_offset))
1465 1465 goto out;
1466 1466 return 0;
1467 1467 out:
net/netfilter/x_tables.c
Diff comments   View file @ 7800007
... ... @@ -289,7 +289,7 @@
289 289 case COMPAT_TO_USER:
290 290 pm = (struct xt_entry_match *)match;
291 291 msize = pm->u.user.match_size;
292   - if (__copy_to_user(*dstptr, pm, msize)) {
  292 + if (copy_to_user(*dstptr, pm, msize)) {
293 293 ret = -EFAULT;
294 294 break;
295 295 }
... ... @@ -366,7 +366,7 @@
366 366 case COMPAT_TO_USER:
367 367 pt = (struct xt_entry_target *)target;
368 368 tsize = pt->u.user.target_size;
369   - if (__copy_to_user(*dstptr, pt, tsize)) {
  369 + if (copy_to_user(*dstptr, pt, tsize)) {
370 370 ret = -EFAULT;
371 371 break;
372 372 }