summaryrefslogtreecommitdiff
path: root/net/ipv4/tcp_probe.c
diff options
context:
space:
mode:
authorTom Quetchenbach <virtualphtn@gmail.com>2008-04-25 08:11:58 +0400
committerDavid S. Miller <davem@davemloft.net>2008-04-25 08:11:58 +0400
commit8d390efd903485923419584275fd0c2aa4c94183 (patch)
treeb7ca93c9bb5d90ed31003106b9f8a73675f3ae3a /net/ipv4/tcp_probe.c
parenta5d6ab56daa439d681aab29955498486e452224d (diff)
downloadlinux-8d390efd903485923419584275fd0c2aa4c94183.tar.xz
tcp: tcp_probe buffer overflow and incorrect return value
tcp_probe has a bounds-checking bug that causes many programs (less, python) to crash reading /proc/net/tcp_probe. When it outputs a log line to the reader, it only checks if that line alone will fit in the reader's buffer, rather than that line and all the previous lines it has already written. tcpprobe_read also returns the wrong value if copy_to_user fails--it just passes on the return value of copy_to_user (number of bytes not copied), which makes a failure look like a success. This patch fixes the buffer overflow and sets the return value to -EFAULT if copy_to_user fails. Patch is against latest net-2.6; tested briefly and seems to fix the crashes in less and python. Signed-off-by: Tom Quetchenbach <virtualphtn@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_probe.c')
-rw-r--r--net/ipv4/tcp_probe.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 1c509592574a..5ff0ce6e9d39 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
width = tcpprobe_sprint(tbuf, sizeof(tbuf));
- if (width < len)
+ if (cnt + width < len)
tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
spin_unlock_bh(&tcp_probe.lock);
/* if record greater than space available
return partial buffer (so far) */
- if (width >= len)
+ if (cnt + width >= len)
break;
- error = copy_to_user(buf + cnt, tbuf, width);
- if (error)
- break;
+ if (copy_to_user(buf + cnt, tbuf, width))
+ return -EFAULT;
cnt += width;
}