tree 7e315a50008d0310dd5572a62baef34ddba89988
parent ac185bdc02c216040f3b83f654d864bd8a29cedc
author Sridhar Samudrala <sri@us.ibm.com> 1156272639 -0700
committer Greg Kroah-Hartman <gregkh@suse.de> 1156276343 -0700

Fix sctp privilege elevation (CVE-2006-3745)

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>