diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2015-01-12 10:51:13 +0100 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2015-01-12 10:51:13 +0100 |
| commit | 2f5eaf66e580f64032b365a00157b6b58c266b37 (patch) | |
| tree | 7852017c864f0eb3833782e2a017952bd8531458 /drivers/connector/connector.c | |
| parent | c291ee622165cb2c8d4e7af63fffd499354a23be (diff) | |
| parent | 91d1179212161f220938198b742c328ad38fd0a3 (diff) | |
Merge tag 'irqchip-urgent-3.19' of git://git.infradead.org/users/jcooper/linux into irq/urgent
irqchip urgent fixes for v3.19 from Jason Cooper
- mtk-sysirq: Fix error handling
- hip04: Fix cpu map for 16bit value
- gic-v3-its: Clear a warning regarding decimal constants
- omap-intc: Fix legacy DMA regression
- atmel-aic-common: Retain priority when changing type
Diffstat (limited to 'drivers/connector/connector.c')
| -rw-r--r-- | drivers/connector/connector.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index f612d68629d..30f522848c7 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -141,12 +141,18 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); */ static int cn_call_callback(struct sk_buff *skb) { + struct nlmsghdr *nlh; struct cn_callback_entry *i, *cbq = NULL; struct cn_dev *dev = &cdev; struct cn_msg *msg = nlmsg_data(nlmsg_hdr(skb)); struct netlink_skb_parms *nsp = &NETLINK_CB(skb); int err = -ENODEV; + /* verify msg->len is within skb */ + nlh = nlmsg_hdr(skb); + if (nlh->nlmsg_len < NLMSG_HDRLEN + sizeof(struct cn_msg) + msg->len) + return -EINVAL; + spin_lock_bh(&dev->cbdev->queue_lock); list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) { if (cn_cb_equal(&i->id.id, &msg->id)) { |