caif: don't set connection request param size before copying data
Subsystems (2)
PATCH 1/1 caif: don't set connection request param size before copying data
The size field should not be set until after the data is successfully copied in.
Signed-off-by Dan Rosenberg <[email protected]>
--- net/caif/caif_socket.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
net/caif/caif_socket.c +1 -1
@@ -740,12 +740,12 @@ static int setsockopt(struct socket *sock,if (cf_sk->sk.sk_protocol !=CAIFPROTO_UTIL )return -ENOPROTOOPT ;lock_sock (&(cf_sk->sk)); - cf_sk->conn_req.param.size = ol;if (ol >sizeof (cf_sk->conn_req.param.data) ||copy_from_user (&cf_sk->conn_req.param.data, ov, ol)) {release_sock (&cf_sk->sk);return -EINVAL ; } + cf_sk->conn_req.param.size = ol;release_sock (&cf_sk->sk);return 0 ;
From: Dan Rosenberg <[email protected]>
Date: Mon, 10 Jan 2011 18:36:37 -0500
Quoted 4 lines
The size field should not be set until after the data is successfully copied in.
Signed-off-by Dan Rosenberg <[email protected]>
Applied, thanks.