diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-02-22 19:30:46 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-03-05 22:48:04 (GMT) |
| commit | c688671d89785238d0da56ee7b0ba00adaa5e260 (patch) | |
| tree | 504d9cfd16c4010f190e845f1ad5593f87b440d2 | |
| parent | 7fe8bd047b4eabcd03074356316b68fea52ab243 (diff) | |
| download | linux-c688671d89785238d0da56ee7b0ba00adaa5e260.tar.xz | |
staging: gdm72xx: underflow in netlink_rcv_cb()
If nlh->nlmsg_len is less than ND_IFINDEX_LEN we end up trying to memcpy
a negative size. I also re-ordered slighty the condition to make it
more uniform.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/gdm72xx/netlink_k.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/staging/gdm72xx/netlink_k.c b/drivers/staging/gdm72xx/netlink_k.c index 783770b..984ca40 100644 --- a/drivers/staging/gdm72xx/netlink_k.c +++ b/drivers/staging/gdm72xx/netlink_k.c @@ -55,7 +55,8 @@ static void netlink_rcv_cb(struct sk_buff *skb) if (skb->len >= NLMSG_HDRLEN) { nlh = (struct nlmsghdr *)skb->data; - if (skb->len < nlh->nlmsg_len || + if (nlh->nlmsg_len < ND_IFINDEX_LEN || + nlh->nlmsg_len > skb->len || nlh->nlmsg_len > ND_MAX_MSG_LEN) { netdev_err(skb->dev, "Invalid length (%d,%d)\n", skb->len, nlh->nlmsg_len); |