net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
authorJason Wang <jasowang@redhat.com>
Wed, 30 May 2012 21:18:10 +0000 (21:18 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 16 Jul 2012 15:47:36 +0000 (08:47 -0700)
commit325b4161bab9ba01b345c4483bbb0e36cb571943
treeb8584bb3b7cd29f3c82793ce68b1cc4cdb41d26c
parentd1877392b4dce5d4c74d329777980d2a3ccede99
net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[ Upstream commit cc9b17ad29ecaa20bfe426a8d4dbfb94b13ff1cc ]

We need to validate the number of pages consumed by data_len, otherwise frags
array could be overflowed by userspace. So this patch validate data_len and
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/core/sock.c