netfilter: ipset: Fix an error code in ip_set_sockfn_get() (30b7244d) · Commits · 戴 / test

The copy_to_user() function returns the number of bytes remaining to be copied. In this code, that positive return is checked at the end of the function and we return zero/success. What we should do instead is return -EFAULT. Fixes: ("netfilter: ipset: IP set core support") Signed-off-by:

Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:

Jozsef Kadlecsik <kadlec@netfilter.org>

net/netfilter/ipset/ip_set_core.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -2069,8 +2069,9 @@ ip_set_sockfn_get(struct sock sk, int optval, void __user user, int *len)
		}

		req_version->version = IPSET_PROTOCOL;
		ret = copy_to_user(user, req_version,
		sizeof(struct ip_set_req_version));
		if (copy_to_user(user, req_version,
		sizeof(struct ip_set_req_version)))
		ret = -EFAULT;
		goto done;
		}
		case IP_SET_OP_GET_BYNAME: {
		@@ -2129,7 +2130,8 @@ ip_set_sockfn_get(struct sock sk, int optval, void __user user, int *len)
		} /* end of switch(op) */

		copy:
		ret = copy_to_user(user, data, copylen);
		if (copy_to_user(user, data, copylen))
		ret = -EFAULT;

		done:
		vfree(data);

Admin message