|
@@ -1918,7 +1918,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
|
|
|
* Afterwards, it will be a kernel pointer. Thus the compiler-assisted
|
|
|
* checking falls down on this.
|
|
|
*/
|
|
|
- if (copy_from_user(ctl_buf, (void __user *)msg_sys.msg_control,
|
|
|
+ if (copy_from_user(ctl_buf,
|
|
|
+ (void __user __force *)msg_sys.msg_control,
|
|
|
ctl_len))
|
|
|
goto out_freectl;
|
|
|
msg_sys.msg_control = ctl_buf;
|
|
@@ -3053,14 +3054,19 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
|
|
|
char *optval, int *optlen)
|
|
|
{
|
|
|
mm_segment_t oldfs = get_fs();
|
|
|
+ char __user *uoptval;
|
|
|
+ int __user *uoptlen;
|
|
|
int err;
|
|
|
|
|
|
+ uoptval = (char __user __force *) optval;
|
|
|
+ uoptlen = (int __user __force *) optlen;
|
|
|
+
|
|
|
set_fs(KERNEL_DS);
|
|
|
if (level == SOL_SOCKET)
|
|
|
- err = sock_getsockopt(sock, level, optname, optval, optlen);
|
|
|
+ err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
|
|
|
else
|
|
|
- err = sock->ops->getsockopt(sock, level, optname, optval,
|
|
|
- optlen);
|
|
|
+ err = sock->ops->getsockopt(sock, level, optname, uoptval,
|
|
|
+ uoptlen);
|
|
|
set_fs(oldfs);
|
|
|
return err;
|
|
|
}
|
|
@@ -3070,13 +3076,16 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
|
|
|
char *optval, unsigned int optlen)
|
|
|
{
|
|
|
mm_segment_t oldfs = get_fs();
|
|
|
+ char __user *uoptval;
|
|
|
int err;
|
|
|
|
|
|
+ uoptval = (char __user __force *) optval;
|
|
|
+
|
|
|
set_fs(KERNEL_DS);
|
|
|
if (level == SOL_SOCKET)
|
|
|
- err = sock_setsockopt(sock, level, optname, optval, optlen);
|
|
|
+ err = sock_setsockopt(sock, level, optname, uoptval, optlen);
|
|
|
else
|
|
|
- err = sock->ops->setsockopt(sock, level, optname, optval,
|
|
|
+ err = sock->ops->setsockopt(sock, level, optname, uoptval,
|
|
|
optlen);
|
|
|
set_fs(oldfs);
|
|
|
return err;
|