|
@@ -1769,6 +1769,9 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
|
|
if (ring->pg_vec == NULL)
|
|
if (ring->pg_vec == NULL)
|
|
goto out_put;
|
|
goto out_put;
|
|
|
|
|
|
|
|
+ if (ring->frame_size - NL_MMAP_HDRLEN < size)
|
|
|
|
+ goto out_put;
|
|
|
|
+
|
|
skb = alloc_skb_head(gfp_mask);
|
|
skb = alloc_skb_head(gfp_mask);
|
|
if (skb == NULL)
|
|
if (skb == NULL)
|
|
goto err1;
|
|
goto err1;
|
|
@@ -1778,6 +1781,7 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
|
|
if (ring->pg_vec == NULL)
|
|
if (ring->pg_vec == NULL)
|
|
goto out_free;
|
|
goto out_free;
|
|
|
|
|
|
|
|
+ /* check again under lock */
|
|
maxlen = ring->frame_size - NL_MMAP_HDRLEN;
|
|
maxlen = ring->frame_size - NL_MMAP_HDRLEN;
|
|
if (maxlen < size)
|
|
if (maxlen < size)
|
|
goto out_free;
|
|
goto out_free;
|