• R
    [NET] compat ifconf: fix limits · 1efa3c05
    Randy Dunlap 提交于
    A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
    causes ifconf data to be truncated 1 entry too early when copying it
    to userspace.  The correct amount of data (length) is returned,
    but the final entry is empty (zero, not filled in).
    The for-loop 'i' check should use <= to allow the final struct
    ifreq32 to be copied.  I also used the ifconf-corruption program
    in kernel bugzilla #4746 to make sure that this change does not
    re-introduce the corruption.
    Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    1efa3c05
compat_ioctl.c 83.6 KB