ctl_len = msg_sys.msg_controllen; 
asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags){	struct compat_msghdr __user *msg_compat = (struct compat_msghdr __user *)msg;	struct socket *sock;	char address[MAX_SOCK_ADDR];	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;	unsigned char ctl[sizeof(struct cmsghdr) + 20];	/* 20 is size of ipv6_pktinfo */	unsigned char *ctl_buf = ctl;	struct msghdr msg_sys;	int err, ctl_len, iov_size, total_len;		err = -EFAULT;	if (MSG_CMSG_COMPAT & flags) {		if (get_compat_msghdr(&msg_sys, msg_compat))			return -EFAULT;	} else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))		return -EFAULT;	sock = sockfd_lookup(fd, &err);	if (!sock) 		goto out;	/* do not move before msg_sys is valid */	err = -EMSGSIZE;	if (msg_sys.msg_iovlen > UIO_MAXIOV)		goto out_put;	/* Check whether to allocate the iovec area*/	err = -ENOMEM;	iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);	if (msg_sys.msg_iovlen > UIO_FASTIOV) {		iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);		if (!iov)			goto out_put;	}	/* This will also move the address data into kernel space */	if (MSG_CMSG_COMPAT & flags) {		err = verify_compat_iovec(&msg_sys, iov, address, VERIFY_READ);	} else		err = verify_iovec(&msg_sys, iov, address, VERIFY_READ);	if (err < 0) 		goto out_freeiov;	total_len = err;	err = -ENOBUFS;	if (msg_sys.msg_controllen > INT_MAX)		goto out_freeiov;	ctl_len = msg_sys.msg_controllen; 	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {		err = cmsghdr_from_user_compat_to_kern(&msg_sys, ctl, sizeof(ctl));		if (err)			goto out_freeiov;		ctl_buf = msg_sys.msg_control;	} else if (ctl_len) {		if (ctl_len > sizeof(ctl))		{			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);			if (ctl_buf == NULL) 				goto out_freeiov;		}		err = -EFAULT;		/*		 * Careful! Before this, msg_sys.msg_control contains a user pointer.		 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted		 * checking falls down on this.		 */		if (copy_from_user(ctl_buf, (void __user *) msg_sys.msg_control, ctl_len))			goto out_freectl;		msg_sys.msg_control = ctl_buf;	}	msg_sys.msg_flags = flags;	if (sock->file->f_flags & O_NONBLOCK)		msg_sys.msg_flags |= MSG_DONTWAIT;	err = sock_sendmsg(sock, &msg_sys, total_len);out_freectl:	if (ctl_buf != ctl)    		sock_kfree_s(sock->sk, ctl_buf, ctl_len);out_freeiov:	if (iov != iovstack)		sock_kfree_s(sock->sk, iov, iov_size);out_put:	sockfd_put(sock);out:       	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/8920e8f94c44e31a73bdf923b04721e26e88cadd/socket.c/buggy/net/socket.c