CVE-2012-2136

BugLink: http://bugs.launchpad.net/bugs/1006622

We need to validate the number of pages consumed by data_len, otherwise frags
array could be overflowed by userspace. So this patch validate data_len and
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.

Jason Wang (1):
net: sock: validate data_len before allocating skb in
sock_alloc_send_pskb()

net/core/sock.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

--
1.7.9.5


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team