diff options
| author | Ingo Molnar <mingo@kernel.org> | 2013-11-01 08:10:58 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2013-11-01 08:24:41 +0100 |
| commit | fb10d5b7efbcc0aa9e46a9aa5ad86772c7bacb9a (patch) | |
| tree | ea284fe7b9c17a85b8d3c4ba999d6e26d51a12f6 /drivers/connector/connector.c | |
| parent | f9f9ffc237dd924f048204e8799da74f9ecf40cf (diff) | |
| parent | 52469b4fcd4fc433ffc78cec4cf94368e9052890 (diff) | |
| download | op-kernel-dev-fb10d5b7efbcc0aa9e46a9aa5ad86772c7bacb9a.zip op-kernel-dev-fb10d5b7efbcc0aa9e46a9aa5ad86772c7bacb9a.tar.gz | |
Merge branch 'linus' into sched/core
Resolve cherry-picking conflicts:
Conflicts:
mm/huge_memory.c
mm/memory.c
mm/mprotect.c
See this upstream merge commit for more details:
52469b4fcd4f Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/connector/connector.c')
| -rw-r--r-- | drivers/connector/connector.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index 6ecfa75..a36749f 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -109,7 +109,7 @@ int cn_netlink_send(struct cn_msg *msg, u32 __group, gfp_t gfp_mask) data = nlmsg_data(nlh); - memcpy(data, msg, sizeof(*data) + msg->len); + memcpy(data, msg, size); NETLINK_CB(skb).dst_group = group; @@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb) static void cn_rx_skb(struct sk_buff *__skb) { struct nlmsghdr *nlh; - int err; struct sk_buff *skb; + int len, err; skb = skb_get(__skb); if (skb->len >= NLMSG_HDRLEN) { nlh = nlmsg_hdr(skb); + len = nlmsg_len(nlh); - if (nlh->nlmsg_len < sizeof(struct cn_msg) || + if (len < (int)sizeof(struct cn_msg) || skb->len < nlh->nlmsg_len || - nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) { + len > CONNECTOR_MAX_MSG_SIZE) { kfree_skb(skb); return; } |
