import PULS_20180308

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / socket.c

diff --git a/net/socket.c b/net/socket.c
index 86363611c821411cc58ae5b51022258795084886..0d716c943918334ae7ba285265f47ee138b76d55 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -1823,6 +1823,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 
        if (len > INT_MAX)
                len = INT_MAX;
+       if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+               return -EFAULT;
        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;
@@ -1882,6 +1884,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 
        if (size > INT_MAX)
                size = INT_MAX;
+       if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+               return -EFAULT;
        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;
@@ -2444,13 +2448,14 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                        break;
        }
 
-out_put:
-       fput_light(sock->file, fput_needed);
-
        if (err == 0)
-               return datagrams;
+               goto out_put;           
+
+       if (datagrams == 0) {
+               datagrams = err;
+               goto out_put;
+       }
 
-       if (datagrams != 0) {
                /*
                 * We may return less entries than requested (vlen) if the
                 * sock is non block and there aren't enough datagrams...
@@ -2465,10 +2470,10 @@ out_put:
                        sock->sk->sk_err = -err;
                }
 
-               return datagrams;
-       }
+out_put:
+       fput_light(sock->file, fput_needed);
 
-       return err;
+       return datagrams;
 }
 
 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,