The variable 'len' is set but unused in data_sock_getsockopt(). The code should use 'len' to validate that the user's socket option is indeed the right size. Signed-off-by: David S. Miller <davem@davemloft.net>
@@ -457,6 +457,9 @@ static int data_sock_getsockopt(struct socket *sock, int level, int optname,
if (get_user(len, optlen))
return -EFAULT;
+ if (len != sizeof(char))
+ return -EINVAL;
+
switch (optname) {
case MISDN_TIME_STAMP:
if (_pms(sk)->cmask & MISDN_TIME_STAMP)