Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb496534 authored by Johannes Berg's avatar Johannes Berg Committed by David S. Miller
Browse files

[NETLINK]: negative groups in netlink_setsockopt 



Reading netlink_setsockopt it's not immediately clear why there isn't a
bug when you pass in negative numbers, the reason being that the >=
comparison is really unsigned although 'val' is signed because
nlk->ngroups is unsigned. Make 'val' unsigned too.

[ Update the get_user() cast to match.  --DaveM ]

Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f77ae939

net/netlink/af_netlink.c

+3 −2
Original line number Diff line number Diff line
@@ -1012,13 +1012,14 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, 
{

	struct sock *sk = sock->sk;

	struct netlink_sock *nlk = nlk_sk(sk);

	int val = 0, err;

	unsigned int val = 0;

	int err;



	if (level != SOL_NETLINK)

		return -ENOPROTOOPT;



	if (optlen >= sizeof(int) &&

	    get_user(val, (int __user *)optval))

	    get_user(val, (unsigned int __user *)optval))

		return -EFAULT;



	switch (optname) {