• T
    tcp: tcp_probe buffer overflow and incorrect return value · 8d390efd
    Tom Quetchenbach 提交于
    tcp_probe has a bounds-checking bug that causes many programs (less,
    python) to crash reading /proc/net/tcp_probe. When it outputs a log
    line to the reader, it only checks if that line alone will fit in the
    reader's buffer, rather than that line and all the previous lines it
    has already written.
    
    tcpprobe_read also returns the wrong value if copy_to_user fails--it
    just passes on the return value of copy_to_user (number of bytes not
    copied), which makes a failure look like a success.
    
    This patch fixes the buffer overflow and sets the return value to
    -EFAULT if copy_to_user fails.
    
    Patch is against latest net-2.6; tested briefly and seems to fix the
    crashes in less and python.
    Signed-off-by: NTom Quetchenbach <virtualphtn@gmail.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    8d390efd
tcp_probe.c 6.0 KB