]> git.baikalelectronics.ru Git - kernel.git/commit
ipv4: Avoid reading user iov twice after raw_probe_proto_opt
authorHerbert Xu <herbert@gondor.apana.org.au>
Fri, 7 Nov 2014 13:27:09 +0000 (21:27 +0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 10 Nov 2014 19:25:35 +0000 (14:25 -0500)
commitae4172a21ff269951bc9f7a9588580125a68d889
treedb116a813dd808850455b36ba1c5e34b523a251e
parent5071000a02498b17a21b5c49f401071fb4b27075
ipv4: Avoid reading user iov twice after raw_probe_proto_opt

Ever since raw_probe_proto_opt was added it had the problem of
causing the user iov to be read twice, once during the probe for
the protocol header and once again in ip_append_data.

This is a potential security problem since it means that whatever
we're probing may be invalid.  This patch plugs the hole by
firstly advancing the iov so we don't read the same spot again,
and secondly saving what we read the first time around for use
by ip_append_data.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/raw.c