diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2014-11-07 21:27:09 +0800 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2019-05-03 19:27:27 +0200 |
| commit | 7a17b3012a24fb479fa911cec84babf74c646e60 (patch) | |
| tree | 25eac4398445190d15a8639608dc65762e9b2223 /net/nfc | |
| parent | 55819f1a4dba0af21755818f587fc6e3e6e9132a (diff) | |
ipv4: Avoid reading user iov twice after raw_probe_proto_opt
commit c008ba5bdc9fa830e1a349b20b0be5a137bdef7a upstream.
Ever since raw_probe_proto_opt was added it had the problem of
causing the user iov to be read twice, once during the probe for
the protocol header and once again in ip_append_data.
This is a potential security problem since it means that whatever
we're probing may be invalid. This patch plugs the hole by
firstly advancing the iov so we don't read the same spot again,
and secondly saving what we read the first time around for use
by ip_append_data.
Change-Id: I549ecbf297ed0bd639a7efabbcfd55368bc71c0d
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/nfc')
0 files changed, 0 insertions, 0 deletions