path: root/kernel/net
diff options
authorJozsef Kadlecsik <>2014-09-01 18:58:43 +0200
committerJozsef Kadlecsik <>2014-09-01 18:58:43 +0200
commit49524319b9dd396cfdf04eaf473390e475600d40 (patch)
tree21af61bb77fd9adb5ed43ec5d4658a027da36320 /kernel/net
parent9dda587bec7966949c3a7e01f6e7de1c6899a7b8 (diff)
Fix static checker warning in ip_set_core.c
Dan Carpenter reported the following static checker warning: net/netfilter/ipset/ip_set_core.c:1414 call_ad() error: 'nlh->nlmsg_len' from user is not capped properly The payload size is limited now by the max size of size_t.
Diffstat (limited to 'kernel/net')
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c
index 2adf675..807b529 100644
--- a/kernel/net/netfilter/ipset/ip_set_core.c
+++ b/kernel/net/netfilter/ipset/ip_set_core.c
@@ -1417,7 +1417,8 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
struct nlmsghdr *rep, *nlh = nlmsg_hdr(skb);
struct sk_buff *skb2;
struct nlmsgerr *errmsg;
- size_t payload = sizeof(*errmsg) + nlmsg_len(nlh);
+ size_t payload = min(SIZE_MAX,
+ sizeof(*errmsg) + nlmsg_len(nlh));
int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
struct nlattr *cda[IPSET_ATTR_CMD_MAX+1];
struct nlattr *cmdattr;