tcp: tcp_probe buffer overflow and incorrect return value

[karo-tx-linux.git] / net / ipv4 / tcp_probe.c

diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 86624fabc4bf416c501c3ea1f10124b93c0be295..a79a547464a5a21303f75483fef1d1ec63abefa5 100644 (file)
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/ktime.h>
 #include <linux/time.h>
+#include <net/net_namespace.h>
 
 #include <net/tcp.h>
 
@@ -111,6 +112,7 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                        p->snd_una = tp->snd_una;
                        p->snd_cwnd = tp->snd_cwnd;
                        p->snd_wnd = tp->snd_wnd;
+                       p->ssthresh = tcp_current_ssthresh(sk);
                        p->srtt = tp->srtt >> 3;
 
                        tcp_probe.head = (tcp_probe.head + 1) % bufsize;
@@ -129,7 +131,7 @@ static struct jprobe tcp_jprobe = {
        .kp = {
                .symbol_name    = "tcp_rcv_established",
        },
-       .entry  = JPROBE_ENTRY(jtcp_rcv_established),
+       .entry  = jtcp_rcv_established,
 };
 
 static int tcpprobe_open(struct inode * inode, struct file * file)
@@ -188,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 
                width = tcpprobe_sprint(tbuf, sizeof(tbuf));
 
-               if (width < len)
+               if (cnt + width < len)
                        tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
 
                spin_unlock_bh(&tcp_probe.lock);
 
                /* if record greater than space available
                   return partial buffer (so far) */
-               if (width >= len)
+               if (cnt + width >= len)
                        break;
 
-               error = copy_to_user(buf + cnt, tbuf, width);
-               if (error)
-                       break;
+               if (copy_to_user(buf + cnt, tbuf, width))
+                       return -EFAULT;
                cnt += width;
        }
 
@@ -227,7 +228,7 @@ static __init int tcpprobe_init(void)
        if (!tcp_probe.log)
                goto err0;
 
-       if (!proc_net_fops_create(procname, S_IRUSR, &tcpprobe_fops))
+       if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &tcpprobe_fops))
                goto err0;
 
        ret = register_jprobe(&tcp_jprobe);
@@ -237,7 +238,7 @@ static __init int tcpprobe_init(void)
        pr_info("TCP probe registered (port=%d)\n", port);
        return 0;
  err1:
-       proc_net_remove(procname);
+       proc_net_remove(&init_net, procname);
  err0:
        kfree(tcp_probe.log);
        return ret;
@@ -246,7 +247,7 @@ module_init(tcpprobe_init);
 
 static __exit void tcpprobe_exit(void)
 {
-       proc_net_remove(procname);
+       proc_net_remove(&init_net, procname);
        unregister_jprobe(&tcp_jprobe);
        kfree(tcp_probe.log);
 }