1) It allocates kernel memory thus:
kmalloc(sizeof(struct sock_filter)*len, GFP_KERNEL)
and frees it thus:
kfree_s(old_filter, sizeof(struct sock_filter*) * sk->filter);
Is this a memory leak? (sizeof(struct sock_filter) == 8)
2) The instructions are pulled from user space via a plain memcpy(), rather
than copy_from_user(). Along the same lines, sk_chk_filter() checks the
instructions without checking that it has been handed a valid address.
3) The bare htons() and htonl() calls in sk_run_filter() are likely problematic
on big-endians.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/