sctp: fix the length check in sctp_getsockopt_maxburst()
The code in sctp_getsockopt_maxburst() doesn't allow len to be larger then struct sctp_assoc_value, which is a common case where app writers just pass down the sizeof(buf) or something similar. This patch fix the problem. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
d212318c9d
commit
c6db93a58f
|
@ -5286,7 +5286,8 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
|
|||
printk(KERN_WARNING
|
||||
"SCTP: Use struct sctp_assoc_value instead\n");
|
||||
params.assoc_id = 0;
|
||||
} else if (len == sizeof (struct sctp_assoc_value)) {
|
||||
} else if (len >= sizeof(struct sctp_assoc_value)) {
|
||||
len = sizeof(struct sctp_assoc_value);
|
||||
if (copy_from_user(¶ms, optval, len))
|
||||
return -EFAULT;
|
||||
} else
|
||||
|
|
Loading…
Reference in a new issue