From: Dan Rosenberg Date: Wed, 22 Dec 2010 13:58:27 +0000 (+0000) Subject: irda: prevent integer underflow in IRLMP_ENUMDEVICES X-Git-Tag: v2.6.37-rc8~13^2~5 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fdac1e0697356ac212259f2147aa60c72e334861;p=pandora-kernel.git irda: prevent integer underflow in IRLMP_ENUMDEVICES If the user-provided len is less than the expected offset, the IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large size value. While this isn't be a security issue on x86 because it will get caught by the access_ok() check, it may leak large amounts of kernel heap on other architectures. In any event, this patch fixes it. Signed-off-by: Dan Rosenberg Signed-off-by: David S. Miller --- Reading git-diff-tree failed