aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-05-03 23:20:27 -0700
committerDavid S. Miller <davem@davemloft.net>2006-05-03 23:20:27 -0700
commit7800007c1e2d42cd4120b87b0ba3f3480f17f30a (patch)
tree831514416c91adcf7bdf87b6c6fd8d7660e1883e /net
parent7582e9d17edbabab6cbe59467c5d1b5e8c04fca8 (diff)
downloadkernel_samsung_tuna-7800007c1e2d42cd4120b87b0ba3f3480f17f30a.zip
kernel_samsung_tuna-7800007c1e2d42cd4120b87b0ba3f3480f17f30a.tar.gz
kernel_samsung_tuna-7800007c1e2d42cd4120b87b0ba3f3480f17f30a.tar.bz2
[NETFILTER]: x_tables: don't use __copy_{from,to}_user on unchecked memory in compat layer
Noticed by Linus Torvalds <torvalds@osdl.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/netfilter/ip_tables.c6
-rw-r--r--net/netfilter/x_tables.c4
2 files changed, 5 insertions, 5 deletions
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 6d1c115..cee3397 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1441,7 +1441,7 @@ static int compat_copy_entry_to_user(struct ipt_entry *e,
ret = -EFAULT;
origsize = *size;
ce = (struct compat_ipt_entry __user *)*dstptr;
- if (__copy_to_user(ce, e, sizeof(struct ipt_entry)))
+ if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
goto out;
*dstptr += sizeof(struct compat_ipt_entry);
@@ -1459,9 +1459,9 @@ static int compat_copy_entry_to_user(struct ipt_entry *e,
goto out;
ret = -EFAULT;
next_offset = e->next_offset - (origsize - *size);
- if (__put_user(target_offset, &ce->target_offset))
+ if (put_user(target_offset, &ce->target_offset))
goto out;
- if (__put_user(next_offset, &ce->next_offset))
+ if (put_user(next_offset, &ce->next_offset))
goto out;
return 0;
out:
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 17abf60..99293c6 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -289,7 +289,7 @@ int xt_compat_match(void *match, void **dstptr, int *size, int convert)
case COMPAT_TO_USER:
pm = (struct xt_entry_match *)match;
msize = pm->u.user.match_size;
- if (__copy_to_user(*dstptr, pm, msize)) {
+ if (copy_to_user(*dstptr, pm, msize)) {
ret = -EFAULT;
break;
}
@@ -366,7 +366,7 @@ int xt_compat_target(void *target, void **dstptr, int *size, int convert)
case COMPAT_TO_USER:
pt = (struct xt_entry_target *)target;
tsize = pt->u.user.target_size;
- if (__copy_to_user(*dstptr, pt, tsize)) {
+ if (copy_to_user(*dstptr, pt, tsize)) {
ret = -EFAULT;
break;
}