cfg80211: fix NULL ptr deref

[safe/jmp/linux-2.6] / net / core / filter.c

diff --git a/net/core/filter.c b/net/core/filter.c
index bbb53c6..d1d779c 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -27,6 +27,7 @@
 #include <linux/if_packet.h>
 #include <net/ip.h>
 #include <net/protocol.h>
+#include <net/netlink.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <linux/errno.h>
@@ -67,7 +68,6 @@ static inline void *load_pointer(struct sk_buff *skb, int k,
  *     sk_filter - run a packet through a socket filter
  *     @sk: sock associated with &sk_buff
  *     @skb: buffer to filter
- *     @needlock: set to 1 if the sock is not locked by caller.
  *
  * Run the filter code and then cut skb->data to correct size returned by
  * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
@@ -212,7 +212,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
 load_w:
                        ptr = load_pointer(skb, k, 4, &tmp);
                        if (ptr != NULL) {
-                               A = ntohl(get_unaligned((__be32 *)ptr));
+                               A = get_unaligned_be32(ptr);
                                continue;
                        }
                        break;
@@ -221,7 +221,7 @@ load_w:
 load_h:
                        ptr = load_pointer(skb, k, 2, &tmp);
                        if (ptr != NULL) {
-                               A = ntohs(get_unaligned((__be16 *)ptr));
+                               A = get_unaligned_be16(ptr);
                                continue;
                        }
                        break;
@@ -303,6 +303,41 @@ load_b:
                case SKF_AD_IFINDEX:
                        A = skb->dev->ifindex;
                        continue;
+               case SKF_AD_NLATTR: {
+                       struct nlattr *nla;
+
+                       if (skb_is_nonlinear(skb))
+                               return 0;
+                       if (A > skb->len - sizeof(struct nlattr))
+                               return 0;
+
+                       nla = nla_find((struct nlattr *)&skb->data[A],
+                                      skb->len - A, X);
+                       if (nla)
+                               A = (void *)nla - (void *)skb->data;
+                       else
+                               A = 0;
+                       continue;
+               }
+               case SKF_AD_NLATTR_NEST: {
+                       struct nlattr *nla;
+
+                       if (skb_is_nonlinear(skb))
+                               return 0;
+                       if (A > skb->len - sizeof(struct nlattr))
+                               return 0;
+
+                       nla = (struct nlattr *)&skb->data[A];
+                       if (nla->nla_len > A - skb->len)
+                               return 0;
+
+                       nla = nla_find_nested(nla, X);
+                       if (nla)
+                               A = (void *)nla - (void *)skb->data;
+                       else
+                               A = 0;
+                       continue;
+               }
                default:
                        return 0;
                }