2 files changed, 11 insertions, 2 deletions

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 597732c989ca..e88b80d41f73 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -439,6 +439,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
 {
         struct ethtool_rxnfc info;
         size_t info_size = sizeof(info);
+        int rc;
 
         if (!dev->ethtool_ops->set_rxnfc)
                 return -EOPNOTSUPP;
@@ -454,7 +455,15 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
         if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
-        return dev->ethtool_ops->set_rxnfc(dev, &info);
+        rc = dev->ethtool_ops->set_rxnfc(dev, &info);
+        if (rc)
+                return rc;
+
+        if (cmd == ETHTOOL_SRXCLSRLINS &&
+            copy_to_user(useraddr, &info, info_size))
+                return -EFAULT;
+
+        return 0;
 }
 
 static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
diff --git a/net/socket.c b/net/socket.c
index e62b4f055071..2cad581318fe 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2758,10 +2758,10 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
         case ETHTOOL_GRXRINGS:
         case ETHTOOL_GRXCLSRLCNT:
         case ETHTOOL_GRXCLSRULE:
+        case ETHTOOL_SRXCLSRLINS:
                 convert_out = true;
                 /* fall through */
         case ETHTOOL_SRXCLSRLDEL:
-        case ETHTOOL_SRXCLSRLINS:
                 buf_size += sizeof(struct ethtool_rxnfc);
                 convert_in = true;
                 break;