[PATCH] ethtool_get_regs copy right number of bytes to user
From: Chris Wright <hidden>
Date: 2004-06-15 22:55:44
If regs.len is smaller than reglen it's possible to copy more bytes out than the user asked for. Signed-off-by: Chris Wright <redacted> ===== net/core/ethtool.c 1.14 vs edited =====
--- 1.14/net/core/ethtool.c 2004-06-02 14:54:28 -07:00
+++ edited/net/core/ethtool.c 2004-06-13 12:59:15 -07:00@@ -157,7 +157,7 @@ if (copy_to_user(useraddr, ®s, sizeof(regs))) goto out; useraddr += offsetof(struct ethtool_regs, data); - if (copy_to_user(useraddr, regbuf, reglen)) + if (copy_to_user(useraddr, regbuf, regs.len)) goto out; ret = 0;