• Colin Ian King's avatar
    net: tehuti: don't process data if it has not been copied from userspace · 1e6c22ae
    Colin Ian King authored
    The array data is only populated with valid information from userspace
    if cmd != SIOCDEVPRIVATE, other cases the array contains garbage on
    the stack. The subsequent switch statement acts on a subcommand in
    data[0] which could be any garbage value if cmd is SIOCDEVPRIVATE which
    seems incorrect to me.  Instead, just return EOPNOTSUPP for the case
    where cmd == SIOCDEVPRIVATE to avoid this issue.
    
    As a side note, I suspect that the original intention of the code
    was for this ioctl to work just for cmd == SIOCDEVPRIVATE (and the
    current logic is reversed). However, I don't wont to change the current
    semantics in case any userspace code relies on this existing behaviour.
    
    Detected by CoverityScan, CID#139647 ("Uninitialized scalar variable")
    Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    1e6c22ae
tehuti.c 65.9 KB