201-fix_dereferencing_pointers.patch (1415B)
1 --- a/src/linux/xt_coova.c 2 +++ b/src/linux/xt_coova.c 3 @@ -292,6 +292,8 @@ static int coova_mt_check(const struct x 4 struct coova_table *t; 5 #ifdef CONFIG_PROC_FS 6 struct proc_dir_entry *pde; 7 + kuid_t uid; 8 + kgid_t gid; 9 #endif 10 unsigned i; 11 int ret = 0; 12 @@ -330,8 +332,9 @@ static int coova_mt_check(const struct x 13 ret = -ENOMEM; 14 goto out; 15 } 16 - pde->uid = ip_list_uid; 17 - pde->gid = ip_list_gid; 18 + uid = make_kuid(&init_user_ns, ip_list_uid); 19 + gid = make_kgid(&init_user_ns, ip_list_gid); 20 + proc_set_user(pde, uid, gid); 21 #endif 22 spin_lock_bh(&coova_lock); 23 list_add_tail(&t->list, &tables); 24 @@ -445,14 +448,13 @@ static const struct seq_operations coova 25 26 static int coova_seq_open(struct inode *inode, struct file *file) 27 { 28 - struct proc_dir_entry *pde = PDE(inode); 29 struct coova_iter_state *st; 30 31 st = __seq_open_private(file, &coova_seq_ops, sizeof(*st)); 32 if (st == NULL) 33 return -ENOMEM; 34 35 - st->table = pde->data; 36 + st->table = PDE_DATA(inode); 37 return 0; 38 } 39 40 @@ -460,8 +462,7 @@ static ssize_t 41 coova_mt_proc_write(struct file *file, const char __user *input, 42 size_t size, loff_t *loff) 43 { 44 - const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode); 45 - struct coova_table *t = pde->data; 46 + struct coova_table *t = PDE_DATA(file->f_path.dentry->d_inode); 47 struct coova_entry *e; 48 char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")]; 49 const char *c = buf;