net/ipv6/ip6_flowlabel.c: copy_to_user return code
Subsystems (4)
PATCH 4/5 net/ipv6/ip6_flowlabel.c: copy_to_user return code
compile warning cleanup - handle copy_to/from_user error returns
---
kj-domen/net/ipv6/ip6_flowlabel.c | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-)
net/ipv6/ip6_flowlabel.c renamed from net/ipv6/ip6_flowlabel.c~return_code-net_ipv6_ip6_flowlabel +7 -3
@@ -537,9 +537,13 @@ release: goto done;/* Do not check for fault */ -if (!freq.flr_label) -copy_to_user (&((struct in6_flowlabel_req __user *) optval)->flr_label, - &fl->label,sizeof (fl->label)); +if (!freq.flr_label) { +if (copy_to_user (&((struct in6_flowlabel_req __user *)optval)->flr_label, + &fl->label,sizeof (fl->label))) { + err = -EFAULT ; + goto done; + } + } sfl1->fl = fl; sfl1->next = np->ipv6_fl_list;
_
In article <[email protected]> (at Sun, 06 Mar 2005 23:21:17 +0100), [email protected] says:
Quoted 3 lines
compile warning cleanup - handle copy_to/from_user error returns
Wrong. You introduce a leak.
net/ipv6/ip6_flowlabel.c release: · line 542
Quoted 4 lines
net/ipv6/ip6_flowlabel.c renamed from net/ipv6/ip6_flowlabel.c~return_code-net_ipv6_ip6_flowlabel +0
-3/* Do not check for fault */ -if (!freq.flr_label) -copy_to_user (&((struct in6_flowlabel_req __user *) optval)->flr_label, - &fl->label,sizeof (fl->label));
Don't you see the comment: "Do not check for fault?"
--yoshfuji
In article <[email protected]> (at Mon, 07 Mar 2005 07:32:13 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <[email protected]> says:
Quoted 7 lines
In article <[email protected]> (at Sun, 06 Mar 2005 23:21:17 +0100), [email protected] says:
Quoted 3 lines
compile warning cleanup - handle copy_to/from_user error returns
Wrong. You introduce a leak.
Ah, sorry, not really, but I still think it is wrong:fl_intern() insert it to hash, and
then you freed up the memory.
I believe this is wrong.
--yoshfuji
Mr. Hideaki,
Thank you very much (domo arigato gozaimasu) for your feedback. Please see below for my comments.
Quoted 11 lines · On 7 Mar 2005 at 7:38, B wrote:
In article <[email protected]> (at Mon, 07 Mar 2005 07:32:13 +0900 (JST)), YOSHIFUJI Hideaki / $B5HF#1QL@ (B <[email protected]> says:
Quoted 7 lines
In article <[email protected]> (at Sun, 06 Mar 2005 23:21:17 +0100), [email protected] says:
Quoted 3 lines
compile warning cleanup - handle copy_to/from_user error returns
Wrong. You introduce a leak.
Ah, sorry, not really,
Actually, you are correct. This is one of my first attempts at a patch submittal and this is one of a few patches where I did not check for side effects. I will try very much not to make that same mistake again.
Quoted 4 lines
but I still think it is wrong:
fl_intern()insert it to hash, and
then you freed up the memory.
I believe this is wrong.
Yes, you are completely correct, and thank you for catching this.
I will submit a more correct patch shortly.
Quoted 3 lines
--yoshfuji