80aa4e1096
This was found with a manual audit and I don't have a reproducer. We limit ->calling_len and ->called_len when we get them from copy_from_user() in x25_ioctl() so when they come from skb->data then we should cap them there as well. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| af_x25.c | ||
| sysctl_net_x25.c | ||
| x25_dev.c | ||
| x25_facilities.c | ||
| x25_forward.c | ||
| x25_in.c | ||
| x25_link.c | ||
| x25_out.c | ||
| x25_proc.c | ||
| x25_route.c | ||
| x25_subr.c | ||
| x25_timer.c | ||