ipv6: IPV6_PKTINFO relied userspace providing correct length

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Reported-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index eeeaad2e8b5ca7f64d69f31cdf3a7b9852a2a113..40f324655e2439cf6ba62dddecda75c9208a6c5c 100644 (file)
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -404,7 +404,7 @@ sticky_done:
                else if (optlen < sizeof(struct in6_pktinfo) || optval == NULL)
                        goto e_inval;
 
-               if (copy_from_user(&pkt, optval, optlen)) {
+               if (copy_from_user(&pkt, optval, sizeof(struct in6_pktinfo))) {
                                retv = -EFAULT;
                                break;
                }