diff options
| author | Ingo Molnar <mingo@kernel.org> | 2015-03-31 09:08:13 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2015-03-31 09:08:13 +0200 |
| commit | c5e77f5216abdd1d98e6d14d9a3eb4e88d80011a (patch) | |
| tree | a542b5bb7d96a8f37c4d5e3319086064448ed67b /net/socket.c | |
| parent | de81e64b250d3865a75d221a80b4311e3273670a (diff) | |
| parent | e42391cd048809d903291d07f86ed3934ce138e9 (diff) | |
Merge tag 'v4.0-rc6' into timers/core, before applying new patches
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'net/socket.c')
| -rw-r--r-- | net/socket.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/socket.c b/net/socket.c index bbedbfcb42c2..245330ca0015 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len, if (len > INT_MAX) len = INT_MAX; + if (unlikely(!access_ok(VERIFY_READ, buff, len))) + return -EFAULT; sock = sockfd_lookup_light(fd, &err, &fput_needed); if (!sock) goto out; @@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, if (size > INT_MAX) size = INT_MAX; + if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size))) + return -EFAULT; sock = sockfd_lookup_light(fd, &err, &fput_needed); if (!sock) goto out; |