summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorVlad Yasevich <vyasevic@redhat.com>2013-03-13 04:18:58 (GMT)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-03-28 19:17:10 (GMT)
commit53f4dceba1a879130df36b6c4f427fc7379767e9 (patch)
tree644cae50dcd3d7e6ef356d5c44c8daeb20c7ff4f /net
parentdeaf53680597dff17be94d6a075fc5ec3a29fe98 (diff)
downloadlinux-fsl-qoriq-53f4dceba1a879130df36b6c4f427fc7379767e9.tar.xz
rtnetlink: Mask the rta_type when range checking
[ Upstream commit a5b8db91442fce9c9713fcd656c3698f1adde1d6 ] Range/validity checks on rta_type in rtnetlink_rcv_msg() do not account for flags that may be set. This causes the function to return -EINVAL when flags are set on the type (for example NLA_F_NESTED). Signed-off-by: Vlad Yasevich <vyasevic@redhat.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/core/rtnetlink.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 798f920..6212ec9 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2539,7 +2539,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
while (RTA_OK(attr, attrlen)) {
- unsigned int flavor = attr->rta_type;
+ unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
if (flavor) {
if (flavor > rta_max[sz_idx])
return -EINVAL;