diff options
author | Paul Mundt <lethal@linux-sh.org> | 2011-01-06 18:24:07 +0900 |
---|---|---|
committer | Paul Mundt <lethal@linux-sh.org> | 2011-01-06 18:24:07 +0900 |
commit | f862f904d357dc0d3612347a8dbabe6fae037fbb (patch) | |
tree | d7f5c2d5f85fd9e1cfc36beae904dc4f9cca04a3 /net/irda/af_irda.c | |
parent | 6f09e41d704fe0bc9157a5357480751d39361d01 (diff) | |
parent | 3c0eee3fe6a3a1c745379547c7e7c904aa64f6d5 (diff) | |
download | linux-f862f904d357dc0d3612347a8dbabe6fae037fbb.tar.bz2 |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 into sh-latest
Conflicts:
arch/sh/kernel/cpu/sh2a/clock-sh7201.c
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Diffstat (limited to 'net/irda/af_irda.c')
-rw-r--r-- | net/irda/af_irda.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c index a6de3059746d..c9890e25cd4c 100644 --- a/net/irda/af_irda.c +++ b/net/irda/af_irda.c @@ -2280,6 +2280,16 @@ static int irda_getsockopt(struct socket *sock, int level, int optname, switch (optname) { case IRLMP_ENUMDEVICES: + + /* Offset to first device entry */ + offset = sizeof(struct irda_device_list) - + sizeof(struct irda_device_info); + + if (len < offset) { + err = -EINVAL; + goto out; + } + /* Ask lmp for the current discovery log */ discoveries = irlmp_get_discoveries(&list.len, self->mask.word, self->nslots); @@ -2290,15 +2300,9 @@ static int irda_getsockopt(struct socket *sock, int level, int optname, } /* Write total list length back to client */ - if (copy_to_user(optval, &list, - sizeof(struct irda_device_list) - - sizeof(struct irda_device_info))) + if (copy_to_user(optval, &list, offset)) err = -EFAULT; - /* Offset to first device entry */ - offset = sizeof(struct irda_device_list) - - sizeof(struct irda_device_info); - /* Copy the list itself - watch for overflow */ if (list.len > 2048) { err = -EINVAL; |