net: nfc: Fix use-after-free caused by nfc_llcp_find_local

[platform/kernel/linux-starfive.git] / net / compat.c

diff --git a/net/compat.c b/net/compat.c
index fe9be3c..161b7be 100644 (file)
--- a/net/compat.c
+++ b/net/compat.c
@@ -52,6 +52,7 @@ int __get_compat_msghdr(struct msghdr *kmsg,
                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
 
        kmsg->msg_control_is_user = true;
+       kmsg->msg_get_inq = 0;
        kmsg->msg_control_user = compat_ptr(msg->msg_control);
        kmsg->msg_controllen = msg->msg_controllen;
 
@@ -94,7 +95,8 @@ int get_compat_msghdr(struct msghdr *kmsg,
        if (err)
                return err;
 
-       err = import_iovec(save_addr ? READ : WRITE, compat_ptr(msg.msg_iov), msg.msg_iovlen,
+       err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE,
+                          compat_ptr(msg.msg_iov), msg.msg_iovlen,
                           UIO_FASTIOV, iov, &kmsg->msg_iter);
        return err < 0 ? err : 0;
 }