Commit c688671d authored Feb 22, 2016 by Dan Carpenter Committed by Greg Kroah-Hartman Mar 05, 2016

staging: gdm72xx: underflow in netlink_rcv_cb()



If nlh->nlmsg_len is less than ND_IFINDEX_LEN we end up trying to memcpy
a negative size.  I also re-ordered slighty the condition to make it
more uniform.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 7fe8bd04

drivers/staging/gdm72xx/netlink_k.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -55,7 +55,8 @@ static void netlink_rcv_cb(struct sk_buff *skb)
		if (skb->len >= NLMSG_HDRLEN) {
		nlh = (struct nlmsghdr *)skb->data;

		if (skb->len < nlh->nlmsg_len \|\|
		if (nlh->nlmsg_len < ND_IFINDEX_LEN \|\|
		nlh->nlmsg_len > skb->len \|\|
		nlh->nlmsg_len > ND_MAX_MSG_LEN) {
		netdev_err(skb->dev, "Invalid length (%d,%d)\n",
		skb->len, nlh->nlmsg_len);

Admin message