From 897c5effb5bf4dfddf2776018ab4e783b14005fe Mon Sep 17 00:00:00 2001
From: Thomas Graf <tgraf@suug.ch>
Date: Sat, 23 Feb 2008 19:54:36 -0800
Subject: [PATCH] --- yaml --- r: 86298 b: refs/heads/master c:
 1840bb13c22f5b8fd2e242e36c8d6ea3f312be67 h: refs/heads/master v: v3

---
 [refs]                     |  2 +-
 trunk/net/core/rtnetlink.c | 25 +++++++++++++++++++------
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/[refs] b/[refs]
index 3c04407aaf85..5ae3d4cc79cd 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 759afc31332aed66bde20743e7e2d1e47b08aaeb
+refs/heads/master: 1840bb13c22f5b8fd2e242e36c8d6ea3f312be67
diff --git a/trunk/net/core/rtnetlink.c b/trunk/net/core/rtnetlink.c
index e170179cc66f..2bd9c5f7627d 100644
--- a/trunk/net/core/rtnetlink.c
+++ b/trunk/net/core/rtnetlink.c
@@ -722,6 +722,21 @@ static struct net *get_net_ns_by_pid(pid_t pid)
 	return net;
 }
 
+static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
+{
+	if (dev) {
+		if (tb[IFLA_ADDRESS] &&
+		    nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
+			return -EINVAL;
+
+		if (tb[IFLA_BROADCAST] &&
+		    nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
 		      struct nlattr **tb, char *ifname, int modified)
 {
@@ -894,12 +909,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 		goto errout;
 	}
 
-	if (tb[IFLA_ADDRESS] &&
-	    nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
-		goto errout_dev;
-
-	if (tb[IFLA_BROADCAST] &&
-	    nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
+	if ((err = validate_linkmsg(dev, tb)) < 0)
 		goto errout_dev;
 
 	err = do_setlink(dev, ifm, tb, ifname, 0);
@@ -1020,6 +1030,9 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 	else
 		dev = NULL;
 
+	if ((err = validate_linkmsg(dev, tb)) < 0)
+		return err;
+
 	if (tb[IFLA_LINKINFO]) {
 		err = nla_parse_nested(linkinfo, IFLA_INFO_MAX,
 				       tb[IFLA_LINKINFO], ifla_info_policy);