Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <aviro@redhat.com>2005-08-31 10:55:12 +0100
committerChris Wright <chrisw@osdl.org>2005-09-09 19:42:53 -0700
commit0721a681c617fdd498f2f0f40e69895354baf099 (patch)
tree1c27cf638a23c3d68817e7bf441229ec9c3a6af9
parentc255cda2af84db91d19944c092baf5a61c633181 (diff)
[PATCH] raw_sendmsg DoS (CAN-2005-2492)
Fix unchecked __get_user that could be tricked into generating a memory read on an arbitrary address. The result of the read is not returned directly but you may be able to divine some information about it, or use the read to cause a crash on some architectures by reading hardware state. CAN-2005-2492. Fix from Al Viro, ack from Dave Miller. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/ipv4/raw.c2
-rw-r--r--net/ipv6/raw.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index d1835b1bc8c4..1364115e16b2 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -358,7 +358,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
if (type && code) {
get_user(fl->fl_icmp_type, type);
- __get_user(fl->fl_icmp_code, code);
+ get_user(fl->fl_icmp_code, code);
probed = 1;
}
break;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1d4d75b34d32..1c72d49f7796 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -619,7 +619,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
if (type && code) {
get_user(fl->fl_icmp_type, type);
- __get_user(fl->fl_icmp_code, code);
+ get_user(fl->fl_icmp_code, code);
probed = 1;
}
break;