diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-21 05:33:19 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-21 05:33:19 -0800 |
| commit | bf0ca85b712919b1608cd2d5b2aad12105befafe (patch) | |
| tree | a851f2aafb82065f7c0f8bef99878382557c1122 | |
| parent | 32ba26066946961940babbf19a8ecb502d24837d (diff) | |
| parent | e26164ecb17ac450f648870cafb95a3729ddda3c (diff) | |
Merge "net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom"
| -rw-r--r-- | net/socket.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/socket.c b/net/socket.c index 5211c40daecc..1cdfe02104a6 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1664,6 +1664,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len, if (len > INT_MAX) len = INT_MAX; + if (unlikely(!access_ok(VERIFY_READ, buff, len))) + return -EFAULT; err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter); if (unlikely(err)) @@ -1723,6 +1725,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, if (size > INT_MAX) size = INT_MAX; + if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size))) + return -EFAULT; err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter); if (unlikely(err)) return err; |