cn: verify msg->len before making callback
cn: verify msg->len before making callback

The struct cn_msg len field comes from userspace and needs to be
validated.  More logical to do so here where the cn_msg pointer is
pulled out of the sk_buff than the callback which is passed cn_msg *
and might assume no validation is needed.

Reported-by: Dan Carpenter <ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com>
Acked-by: Evgeniy Polyakov <9be07b15919dab1b45f07f962d8e37ba7c50f920@ioremap.net>
Signed-off-by: David Fries <d27937f914ebe99ee315f04449678eccfb658191@Fries.net>
Signed-off-by: Greg Kroah-Hartman <4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs