--- net/irda/af_irda.c

+++ net/irda/af_irda.c

@@ -2164,6 +2164,14 @@ static int irda_getsockopt(struct socket

switch (optname) {

case IRLMP_ENUMDEVICES:

+

+ /* Offset to first device entry */

+ offset = sizeof(struct irda_device_list) -

+ sizeof(struct irda_device_info);

+

+ if (len < offset)

+ return -EINVAL;

+

/* Ask lmp for the current discovery log */

discoveries = irlmp_get_discoveries(&list.len, self->mask.word,

self->nslots);

@@ -2173,15 +2181,9 @@ static int irda_getsockopt(struct socket

err = 0;

/* Write total list length back to client */

- if (copy_to_user(optval, &list,

- sizeof(struct irda_device_list) -

- sizeof(struct irda_device_info)))

+ if (copy_to_user(optval, &list, offset))

err = -EFAULT;

- /* Offset to first device entry */

- offset = sizeof(struct irda_device_list) -

- sizeof(struct irda_device_info);

-

/* Copy the list itself - watch for overflow */

if(list.len > 2048)

{