From: Al Viro Date: Mon, 27 Jul 2020 18:22:20 +0000 (+0100) Subject: fix a braino in cmsghdr_from_user_compat_to_kern() X-Git-Tag: v5.10.7~2038^2~33 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=181964e619b76ae2e71bcdc6001cf977bec4cf6e;p=platform%2Fkernel%2Flinux-rpi.git fix a braino in cmsghdr_from_user_compat_to_kern() commit 547ce4cfb34c ("switch cmsghdr_from_user_compat_to_kern() to copy_from_user()") missed one of the places where ucmlen should've been replaced with cmsg.cmsg_len, now that we are fetching the entire struct rather than doing it field-by-field. As the result, compat sendmsg() with several different-sized cmsg attached started to fail with EINVAL. Trivial to fix, fortunately. Fixes: 547ce4cfb34c ("switch cmsghdr_from_user_compat_to_kern() to copy_from_user()") Reported-by: Nick Bowler Tested-by: Nick Bowler Signed-off-by: Al Viro Signed-off-by: David S. Miller --- diff --git a/net/compat.c b/net/compat.c index 5e3041a..434838b 100644 --- a/net/compat.c +++ b/net/compat.c @@ -202,7 +202,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk, /* Advance. */ kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp); - ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, ucmlen); + ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, cmsg.cmsg_len); } /*