copy_to_user() copies the struct the pointer is pointing to, but the
length check compares against sizeof(pointer) and not sizeof(struct).
On 32-bit the size is probably the same, so it might have worked
accidentally.

Signed-off-by: Matthias Rosenfelder <mrosenfelder.l...@gmail.com>
---
 net/tls/tls_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index a03130a..60aff60 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -272,7 +272,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char 
__user *optval,
                goto out;
        }
 
-       if (len == sizeof(crypto_info)) {
+       if (len == sizeof(*crypto_info)) {
                if (copy_to_user(optval, crypto_info, sizeof(*crypto_info)))
                        rc = -EFAULT;
                goto out;
-- 
2.8.3

Reply via email to