Commit 8005aba6 authored by David S. Miller's avatar David S. Miller
Browse files

[SPARC64]: Fix cmsg length checks in Solaris emulation layer. 



Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1d345dac

arch/sparc64/solaris/socket.c

+4 −2
Original line number Diff line number Diff line
@@ -317,8 +317,10 @@ asmlinkage int solaris_sendmsg(int fd, struct sol_nmsghdr __user *user_msg, unsi 
		unsigned long *kcmsg;

		compat_size_t cmlen;



		if(kern_msg.msg_controllen > sizeof(ctl) &&

		   kern_msg.msg_controllen <= 256) {

		if (kern_msg.msg_controllen <= sizeof(compat_size_t))

			return -EINVAL;



		if(kern_msg.msg_controllen > sizeof(ctl)) {

			err = -ENOBUFS;

			ctl_buf = kmalloc(kern_msg.msg_controllen, GFP_KERNEL);

			if(!ctl_buf)