tree df4a2c33ac2bfda18393fe56500fd0cb58551351
parent 7cc7c5e54b7128195a1403747a63971c3c3f8e25
author Ying Xue <ying.xue@windriver.com> 1382073794 +0200
committer David S. Miller <davem@davemloft.net> 1382116842 -0400

tipc: don't use memcpy to copy from user space

tipc_msg_build() calls skb_copy_to_linear_data_offset() to copy data
from user space to kernel space. However, the latter function does
in its turn call memcpy() to perform the actual copying. This poses
an obvious security and robustness risk, since memcpy() never makes
any validity check on the pointer it is copying from.

To correct this, we the replace the offending function call with
a call to memcpy_fromiovecend(), which uses copy_from_user() to
perform the copying.

Signed-off-by: Ying Xue <ying.xue@windriver.com>
Reviewed-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>