Re: [PATCH] net: compat: assert the size of cmsg copied in is as expected

2017-09-20 Thread David Miller
From: Meng Xu Date: Tue, 19 Sep 2017 13:19:13 -0400 > The actual length of cmsg fetched in during the second loop > (i.e., kcmsg - kcmsg_base) could be different from what we > get from the first loop (i.e., kcmlen). > > The main reason is that the two get_user() calls in the two > loops (i.e.,

[PATCH] net: compat: assert the size of cmsg copied in is as expected

2017-09-19 Thread Meng Xu
The actual length of cmsg fetched in during the second loop (i.e., kcmsg - kcmsg_base) could be different from what we get from the first loop (i.e., kcmlen). The main reason is that the two get_user() calls in the two loops (i.e., get_user(ucmlen, &ucmsg->cmsg_len) and __get_user(ucmlen, &ucmsg->