scm.c (762f99f4f3cb41a775b5157dd761217beba65873) scm.c (5f1eb1ff58ea122e24adf0bc940f268ed2227462)
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* scm.c - Socket level control messages processing.
3 *
4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 * Alignment and value checking mods by Craig Metz
6 */
7
8#include <linux/module.h>

--- 215 unchanged lines hidden (view full) ---

224 if (msg->msg_controllen < cmlen) {
225 msg->msg_flags |= MSG_CTRUNC;
226 cmlen = msg->msg_controllen;
227 }
228
229 if (msg->msg_control_is_user) {
230 struct cmsghdr __user *cm = msg->msg_control_user;
231
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* scm.c - Socket level control messages processing.
3 *
4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 * Alignment and value checking mods by Craig Metz
6 */
7
8#include <linux/module.h>

--- 215 unchanged lines hidden (view full) ---

224 if (msg->msg_controllen < cmlen) {
225 msg->msg_flags |= MSG_CTRUNC;
226 cmlen = msg->msg_controllen;
227 }
228
229 if (msg->msg_control_is_user) {
230 struct cmsghdr __user *cm = msg->msg_control_user;
231
232 check_object_size(data, cmlen - sizeof(*cm), true);
233
232 if (!user_write_access_begin(cm, cmlen))
233 goto efault;
234
235 unsafe_put_user(cmlen, &cm->cmsg_len, efault_end);
236 unsafe_put_user(level, &cm->cmsg_level, efault_end);
237 unsafe_put_user(type, &cm->cmsg_type, efault_end);
238 unsafe_copy_to_user(CMSG_USER_DATA(cm), data,
239 cmlen - sizeof(*cm), efault_end);

--- 128 unchanged lines hidden --- 		234 if (!user_write_access_begin(cm, cmlen))
235 goto efault;
236
237 unsafe_put_user(cmlen, &cm->cmsg_len, efault_end);
238 unsafe_put_user(level, &cm->cmsg_level, efault_end);
239 unsafe_put_user(type, &cm->cmsg_type, efault_end);
240 unsafe_copy_to_user(CMSG_USER_DATA(cm), data,
241 cmlen - sizeof(*cm), efault_end);

--- 128 unchanged lines hidden ---