sit: fix off-by-one in ipip6_tunnel_get_prl

When requesting all prl entries (kprl.addr == INADDR_ANY) and there are more prl entries than there is space passed from userspace, the existing code would always copy cmax+1 entries, which is more than can be handled. This patch makes the kernel copy only exactly cmax entries. Signed-off-by: Sascha Hlusiak <[email protected]> Acked-By: Fred L. Templin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
blinkosm · Sep 30, 2009 · 298bf12 · 298bf12
1 parent d99927f
commit 298bf12
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
@@ -274,7 +274,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
 
 	c = 0;
 	for (prl = t->prl; prl; prl = prl->next) {
-		if (c > cmax)
+		if (c >= cmax)
 			break;
 		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
 			continue;