From: Al Viro <v...@zeniv.linux.org.uk>
Date: Mon, 27 Jul 2020 19:22:20 +0100
> commit 547ce4cfb34c ("switch cmsghdr_from_user_compat_to_kern() to
> copy_from_user()") missed one of the places where ucmlen should've been
> replaced with cmsg.cmsg_len, now that we are fetching the entire struct
> rather than doing it field-by-field.
>
> As the result, compat sendmsg() with several different-sized cmsg
> attached started to fail with EINVAL. Trivial to fix, fortunately.
>
> Reported-by: Nick Bowler <nbow...@draconx.ca>
> Tested-by: Nick Bowler <nbow...@draconx.ca>
> Fixes: 547ce4cfb34c ("switch cmsghdr_from_user_compat_to_kern() to
> copy_from_user()")
>
> Signed-off-by: Al Viro <v...@zeniv.linux.org.uk>
Applied, thanks Al.
