net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function

The 'len' variable can't be negative when assigned the result of
'min_t' because all 'min_t' parameters are cast to unsigned int,
and then the minimum one is chosen.

To fix the logic, check 'len' as read from 'optlen',
where the types of relevant variables are (signed) int.

Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index dc46f17a3187ecec27250542157d3f1780b11dba..2f191e50d4fc94e64ab21018380d2af2aee05e83 100644 (file)
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1153,10 +1153,11 @@ static int kcm_getsockopt(struct socket *sock, int level, int optname,
        if (get_user(len, optlen))
                return -EFAULT;
 
-       len = min_t(unsigned int, len, sizeof(int));
        if (len < 0)
                return -EINVAL;
 
+       len = min_t(unsigned int, len, sizeof(int));
+
        switch (optname) {
        case KCM_RECV_DISABLE:
                val = kcm->rx_disabled;