ipv4: Avoid reading user iov twice after raw_probe_proto_opt
authorHerbert Xu <herbert@gondor.apana.org.au>
Fri, 7 Nov 2014 13:27:09 +0000 (21:27 +0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 10 Nov 2014 19:25:35 +0000 (14:25 -0500)
commitc008ba5bdc9fa830e1a349b20b0be5a137bdef7a
treedb116a813dd808850455b36ba1c5e34b523a251e
parent32b5913a931fd753faf3d4e1124b2bc2edb364da
ipv4: Avoid reading user iov twice after raw_probe_proto_opt

Ever since raw_probe_proto_opt was added it had the problem of
causing the user iov to be read twice, once during the probe for
the protocol header and once again in ip_append_data.

This is a potential security problem since it means that whatever
we're probing may be invalid.  This patch plugs the hole by
firstly advancing the iov so we don't read the same spot again,
and secondly saving what we read the first time around for use
by ip_append_data.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/raw.c