]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
irda: prevent integer underflow in IRLMP_ENUMDEVICES
authorDan Rosenberg <drosenberg@vsecurity.com>
Wed, 22 Dec 2010 13:58:27 +0000 (13:58 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 23 Dec 2010 18:09:43 +0000 (10:09 -0800)
commitfdac1e0697356ac212259f2147aa60c72e334861
treece479592fda66f81e1058c02b813dbc168958197
parent1bde5ac49398a064c753bb490535cfad89e99a5f
irda: prevent integer underflow in IRLMP_ENUMDEVICES

If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value.  While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures.  In any event, this patch fixes it.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/irda/af_irda.c