From: David Fries <David@Fries.net>
Date: Tue, 11 Nov 2014 02:19:36 +0000 (-0600)
Subject: cn: verify msg->len before making callback
X-Git-Tag: omap-for-v3.19/fixes-rc1~84^2~15
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a30cfa475d1a26c18f1998ba1e034a4e2ab4c7a8;p=pandora-kernel.git

cn: verify msg->len before making callback

The struct cn_msg len field comes from userspace and needs to be
validated.  More logical to do so here where the cn_msg pointer is
pulled out of the sk_buff than the callback which is passed cn_msg *
and might assume no validation is needed.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: David Fries <David@Fries.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

Reading git-diff-tree failed