1 files changed, 6 insertions, 1 deletions

diff --git a/net/socket.c b/net/socket.c
index 49917a1cac7d..41e8847508aa 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         unsigned long a[6];
         unsigned long a0, a1;
         int err;
+        unsigned int len;
 
         if (call < 1 || call > SYS_ACCEPT4)
                 return -EINVAL;
 
+        len = nargs[call];
+        if (len > sizeof(a))
+                return -EINVAL;
+
         /* copy_from_user should be SMP safe. */
-        if (copy_from_user(a, args, nargs[call]))
+        if (copy_from_user(a, args, len))
                 return -EFAULT;
 
         audit_socketcall(nargs[call] / sizeof(unsigned long), a);