kernel/net/core/bpf_sk_storage.c
.. .. @@ -446,8 +446,11 @@ 446 446 return ERR_PTR(-EPERM); 447 447 448 448 nla_for_each_nested(nla, nla_stgs, rem) { 449 - if (nla_type(nla) == SK_DIAG_BPF_STORAGE_REQ_MAP_FD)449 + if (nla_type(nla) == SK_DIAG_BPF_STORAGE_REQ_MAP_FD) {450 + if (nla_len(nla) != sizeof(u32))451 + return ERR_PTR(-EINVAL);450 452 nr_maps++; 453 + }451 454 } 452 455 453 456 diag = kzalloc(sizeof(*diag) + sizeof(diag->maps[0]) * nr_maps,