1 files changed, 7 insertions, 0 deletions

diff --git a/net/compat.c b/net/compat.c
index 6ded6c821d7a..22381719718c 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -185,6 +185,13 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
                 ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, ucmlen);
         }
 
+        /*
+         * check the length of messages copied in is the same as the
+         * what we get from the first loop
+         */
+        if ((char *)kcmsg - (char *)kcmsg_base != kcmlen)
+                goto Einval;
+
         /* Ok, looks like we made it.  Hook it up and return success. */
         kmsg->msg_control = kcmsg_base;
         kmsg->msg_controllen = kcmlen;