[IPV4/IPV6]: Fix direct user pointer deref in xfrm icmp changes.

Signed-off-by: David S. Miller <davem@redhat.com>

net/ipv4/raw.c

@@ -326,8 +326,8 @@ static int raw_send_hdrinc(struct sock *sk, void *from, int length,
 static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 {
 	struct iovec *iov;
-	u8 *type = NULL;
-	u8 *code = NULL;
+	u8 __user *type = NULL;
+	u8 __user *code = NULL;
 	int probed = 0;
 	int i;
 
@@ -354,8 +354,8 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 				code = iov->iov_base;
 
 			if (type && code) {
-				fl->fl_icmp_type = *type;
-				fl->fl_icmp_code = *code;
+				get_user(fl->fl_icmp_type, type);
+				__get_user(fl->fl_icmp_code, code);
 				probed = 1;
 			}
 			break;

net/ipv6/raw.c

@@ -559,8 +559,8 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
 static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 {
 	struct iovec *iov;
-	u8 *type = NULL;
-	u8 *code = NULL;
+	u8 __user *type = NULL;
+	u8 __user *code = NULL;
 	int probed = 0;
 	int i;
 
@@ -587,8 +587,8 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 				code = iov->iov_base;
 
 			if (type && code) {
-				fl->fl_icmp_type = *type;
-				fl->fl_icmp_code = *code;
+				get_user(fl->fl_icmp_type, type);
+				__get_user(fl->fl_icmp_code, code);
 				probed = 1;
 			}
 			break;