소스 검색

TLS: Fix length check in do_tls_getsockopt_tx()

copy_to_user() copies the struct the pointer is pointing to, but the
length check compares against sizeof(pointer) and not sizeof(struct).
On 32-bit the size is probably the same, so it might have worked
accidentally.

Signed-off-by: Matthias Rosenfelder <mrosenfelder.lkml@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Matthias Rosenfelder 8 년 전
부모
커밋
5a3b886c3c
1개의 변경된 파일1개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      net/tls/tls_main.c

+ 1 - 1
net/tls/tls_main.c

@@ -272,7 +272,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
 		goto out;
 	}
 
-	if (len == sizeof(crypto_info)) {
+	if (len == sizeof(*crypto_info)) {
 		if (copy_to_user(optval, crypto_info, sizeof(*crypto_info)))
 			rc = -EFAULT;
 		goto out;