diff options
| author | David S. Miller <davem@davemloft.net> | 2005-09-17 01:51:01 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2005-09-17 01:51:01 +0200 |
| commit | 37f7f421cce13435fdc0d870caf51141e5ebf079 (patch) | |
| tree | 402e68f26b4bd54df721589f8f0b2a9c67a01678 | |
| parent | [PATCH] vc: Use correct size on buffer copy in vc_resize (diff) | |
| download | linux-37f7f421cce13435fdc0d870caf51141e5ebf079.tar.xz linux-37f7f421cce13435fdc0d870caf51141e5ebf079.zip | |
[NET]: Do not leak MSG_CMSG_COMPAT into userspace.
Noticed by Sridhar Samudrala.
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/socket.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/socket.c b/net/socket.c index c699e93c33d7..f9264472377f 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1862,7 +1862,8 @@ asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg, unsigned int flag if (err < 0) goto out_freeiov; } - err = __put_user(msg_sys.msg_flags, COMPAT_FLAGS(msg)); + err = __put_user((msg_sys.msg_flags & ~MSG_CMSG_COMPAT), + COMPAT_FLAGS(msg)); if (err) goto out_freeiov; if (MSG_CMSG_COMPAT & flags) |