ipv6: IPV6_PKTINFO relied userspace providing correct length

ij1 · davem330 · commit 914d11647b6d · 2009-01-04T17:27:31.000-08:00
Signed-off-by: Ilpo Järvinen &lt;ilpo.jarvinen@helsinki.fi&gt;
Reported-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
@@ -404,7 +404,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 		else if (optlen < sizeof(struct in6_pktinfo) || optval == NULL)
 			goto e_inval;
 
-		if (copy_from_user(&pkt, optval, optlen)) {
+		if (copy_from_user(&pkt, optval, sizeof(struct in6_pktinfo))) {
 				retv = -EFAULT;
 				break;
 		}

Original file line number	Diff line number	Diff line change
`@@ -404,7 +404,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,`
`404`	`404`	`else if (optlen < sizeof(struct in6_pktinfo) \|\| optval == NULL)`
`405`	`405`	`goto e_inval;`
`406`	`406`
`407`		`- if (copy_from_user(&pkt, optval, optlen)) {`
	`407`	`+ if (copy_from_user(&pkt, optval, sizeof(struct in6_pktinfo))) {`
`408`	`408`	`retv = -EFAULT;`
`409`	`409`	`break;`
`410`	`410`	`}`