Commit 149118d8 authored by Thomas Graf's avatar Thomas Graf Committed by David S. Miller

netlink: Warn on unordered or illegal nla_nest_cancel() or nlmsg_cancel()

Calling nla_nest_cancel() in a different order as the nesting was
built up can lead to negative offsets being calculated which
results in skb_trim() being called with an underflowed unsigned
int. Warn if mark < skb->data as it's definitely a bug.
Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a515abd7
...@@ -520,8 +520,10 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb) ...@@ -520,8 +520,10 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
*/ */
static inline void nlmsg_trim(struct sk_buff *skb, const void *mark) static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
{ {
if (mark) if (mark) {
WARN_ON((unsigned char *) mark < skb->data);
skb_trim(skb, (unsigned char *) mark - skb->data); skb_trim(skb, (unsigned char *) mark - skb->data);
}
} }
/** /**
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment