David Fries a30cfa475d cn: verify msg->len before making callback
The struct cn_msg len field comes from userspace and needs to be
validated.  More logical to do so here where the cn_msg pointer is
pulled out of the sk_buff than the callback which is passed cn_msg *
and might assume no validation is needed.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: David Fries <David@Fries.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-26 19:09:01 -08:00
..
2014-10-08 17:37:16 -04:00
2014-10-15 07:23:49 +02:00
2014-10-07 21:29:18 -04:00
2014-10-15 06:58:16 +02:00
2014-11-02 14:45:52 -08:00
2014-10-31 18:48:29 -07:00
2014-10-21 08:17:43 -07:00
2014-10-08 17:37:16 -04:00
2014-10-29 09:24:42 -07:00
2014-10-15 07:23:49 +02:00