The sk_unattached_filter_create function is passed a socket
filter structure and the copies the contents of the filter from
userspace. Sparse detected that this code was incorrectly using
memcpy when it needed to use copy_from_user instead.
The only use of sk_unattached_filter_create at present is in
the team driver.
Signed-off-by: Stephen Hemminger <redacted>
--- a/net/core/filter.c 2012-10-09 10:35:03.183141638 -0700
+++ b/net/core/filter.c 2012-10-13 11:33:05.955531440 -0700
@@ -666,7 +666,9 @@ int sk_unattached_filter_create(struct s
fp = kmalloc(fsize + sizeof(*fp), GFP_KERNEL);
if (!fp)
return -ENOMEM;
- memcpy(fp->insns, fprog->filter, fsize);
+
+ if (copy_from_user(fp->insns, fprog->filter, fsize))
+ return -EFAULT;
atomic_set(&fp->refcnt, 1);
fp->len = fprog->len;