In hex32_arg() and num_arg() error out in case no characters are available (maxlen = 0).
Signed-off-by: Peter Seiderer ps.report@gmx.net --- Changes v3 -> v4 - new patch (factored out of patch 'net: pktgen: fix access outside of user given buffer in pktgen_if_write()') --- net/core/pktgen.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 3c42ecf17ba2..cb3b732fd0a3 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -761,6 +761,9 @@ static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, int i = 0; *num = 0;
+ if (!maxlen) + return -EINVAL; + for (; i < maxlen; i++) { int value; char c; @@ -808,6 +811,9 @@ static long num_arg(const char __user *user_buffer, unsigned long maxlen, int i; *num = 0;
+ if (!maxlen) + return -EINVAL; + for (i = 0; i < maxlen; i++) { char c; if (get_user(c, &user_buffer[i]))