diff --git a/[refs] b/[refs] index 4d3d352bf1b6..d2b3c369992a 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: c5c0f33d8e5b1219c86757e6afffd6f96823e521 +refs/heads/master: 1ac70e7ad24a88710cf9b6d7ababaefa2b575df0 diff --git a/trunk/net/compat.c b/trunk/net/compat.c index d74d82155d78..377e560ab5c9 100644 --- a/trunk/net/compat.c +++ b/trunk/net/compat.c @@ -254,6 +254,8 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat if (copy_to_user(CMSG_COMPAT_DATA(cm), data, cmlen - sizeof(struct compat_cmsghdr))) return -EFAULT; cmlen = CMSG_COMPAT_SPACE(len); + if (kmsg->msg_controllen < cmlen) + cmlen = kmsg->msg_controllen; kmsg->msg_control += cmlen; kmsg->msg_controllen -= cmlen; return 0; diff --git a/trunk/net/core/scm.c b/trunk/net/core/scm.c index 100ba6d9d478..10f5c65f6a47 100644 --- a/trunk/net/core/scm.c +++ b/trunk/net/core/scm.c @@ -196,6 +196,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr))) goto out; cmlen = CMSG_SPACE(len); + if (msg->msg_controllen < cmlen) + cmlen = msg->msg_controllen; msg->msg_control += cmlen; msg->msg_controllen -= cmlen; err = 0;