Merge "net: ipc_router: fix leak of kernel memory to userspace" (2e5d74bc) · Commits · e / devices / android_kernel_xiaomi_markw

net/ipc_router/ipc_router_socket.c

+11 −6

Original line number	Diff line number	Diff line
		/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -496,13 +496,18 @@ static int msm_ipc_router_ioctl(struct socket *sock,

		ret = copy_to_user((void *)arg, &server_arg,
		sizeof(server_arg));
		if (srv_info_sz) {

		n = min(server_arg.num_entries_found,
		server_arg.num_entries_in_array);

		if (ret == 0 && n) {
		ret = copy_to_user((void *)(arg + sizeof(server_arg)),
		srv_info, srv_info_sz);
		srv_info, n * sizeof(*srv_info));
		}

		if (ret)
		ret = -EFAULT;
		kfree(srv_info);
		}
		break;

		case IPC_ROUTER_IOCTL_BIND_CONTROL_PORT: