projects
/
firefly-linux-kernel-4.4.55.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
UPSTREAM: brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()
[firefly-linux-kernel-4.4.55.git]
/
drivers
/
net
/
macvtap.c
diff --git
a/drivers/net/macvtap.c
b/drivers/net/macvtap.c
index 0fc521941c718dbcdea487a18a900984ad176ea5..159a68782bec9ac172c5fa168fe7dc05605f7ad4 100644
(file)
--- a/
drivers/net/macvtap.c
+++ b/
drivers/net/macvtap.c
@@
-760,6
+760,8
@@
static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN;
if (copylen > good_linear)
copylen = good_linear;
macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN;
if (copylen > good_linear)
copylen = good_linear;
+ else if (copylen < ETH_HLEN)
+ copylen = ETH_HLEN;
linear = copylen;
i = *from;
iov_iter_advance(&i, copylen);
linear = copylen;
i = *from;
iov_iter_advance(&i, copylen);
@@
-769,10
+771,11
@@
static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
if (!zerocopy) {
copylen = len;
if (!zerocopy) {
copylen = len;
- if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear)
+ linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
+ if (linear > good_linear)
linear = good_linear;
linear = good_linear;
- else
- linear =
macvtap16_to_cpu(q, vnet_hdr.hdr_len)
;
+ else
if (linear < ETH_HLEN)
+ linear =
ETH_HLEN
;
}
skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
}
skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,