[PATCH] ethtool_get_regs copy right number of bytes to user

If regs.len is smaller than reglen it's possible to copy more bytes out
than the user asked for.

Signed-off-by: Chris Wright <chrisw@osdl.org>

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d996db79854ba2d5689dd180496974bcdd9ab2b1..866f29277ed1318c6961524441fba79c44921edc 100644 (file)
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -157,7 +157,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
        if (copy_to_user(useraddr, &regs, sizeof(regs)))
                goto out;
        useraddr += offsetof(struct ethtool_regs, data);
-       if (copy_to_user(useraddr, regbuf, reglen))
+       if (copy_to_user(useraddr, regbuf, regs.len))
                goto out;
        ret = 0;