[PATCH] ethtool_get_regs copy right number of bytes to user

[Chris Wright]

If regs.len is smaller than reglen it's possible to copy more bytes out
than the user asked for.

Signed-off-by: Chris Wright <chrisw@xxxxxxxx>

===== net/core/ethtool.c 1.14 vs edited =====
--- 1.14/net/core/ethtool.c	2004-06-02 14:54:28 -07:00
+++ edited/net/core/ethtool.c	2004-06-13 12:59:15 -07:00
@@ -157,7 +157,7 @@
 	if (copy_to_user(useraddr, &regs, sizeof(regs)))
 		goto out;
 	useraddr += offsetof(struct ethtool_regs, data);
-	if (copy_to_user(useraddr, regbuf, reglen))
+	if (copy_to_user(useraddr, regbuf, regs.len))
 		goto out;
 	ret = 0;
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/