From: Erik Hugne <erik.hugne@ericsson.com>
Date: Mon, 28 Apr 2014 06:20:09 +0000 (+0200)
Subject: tipc: fix out of bounds indexing
X-Git-Tag: omap-for-v3.16/fixes-against-rc1~36^2~298
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d7bb74c38cb3de40600dcbba50a4f84df290dc91;p=pandora-kernel.git

tipc: fix out of bounds indexing

Commit 78acb1f9b898e85fa2c1e28e700b54b66b288e8d ("tipc: add
ioctl to fetch link names") introduced a buffer overflow bug where
specially crafted ioctl requests could cause out-of-bounds indexing
of the node->links array. This was caused by an incorrect check vs
MAX_BEARERS, and the static code checker complaint is:
net/tipc/node.c:459 tipc_node_get_linkname() error: buffer overflow 'node->links' 2 <= 2

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed