diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2017-07-01 08:03:10 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2018-01-24 19:13:45 -0500 |
| commit | ca25c30040f93c127ff1651aa636c0174f1e0cdb (patch) | |
| tree | 03025f47a77cbcb5dc28a4124a36301a9143958f /net/ipv4/af_inet.c | |
| parent | 03aef17bb79b3dc02b1352ee2f55fca799dbad7f (diff) | |
ip_rt_ioctl(): take copyin to caller
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'net/ipv4/af_inet.c')
| -rw-r--r-- | net/ipv4/af_inet.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 1c2bfee2e249..c24008daa3d8 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -874,6 +874,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) struct net *net = sock_net(sk); void __user *p = (void __user *)arg; struct ifreq ifr; + struct rtentry rt; switch (cmd) { case SIOCGSTAMP: @@ -884,8 +885,12 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) break; case SIOCADDRT: case SIOCDELRT: + if (copy_from_user(&rt, p, sizeof(struct rtentry))) + return -EFAULT; + err = ip_rt_ioctl(net, cmd, &rt); + break; case SIOCRTMSG: - err = ip_rt_ioctl(net, cmd, (void __user *)arg); + err = -EINVAL; break; case SIOCDARP: case SIOCGARP: |