forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-10-22 8ac6c7a54ed1b98d142dce24b11c6de6a1e239a5 
 kernel/lib/nlattr.c
....@@ -10,6 +10,7 @@
1010 #include <linux/kernel.h>
1111 #include <linux/errno.h>
1212 #include <linux/jiffies.h>
13
+#include <linux/nospec.h>
1314 #include <linux/skbuff.h>
1415 #include <linux/string.h>
1516 #include <linux/types.h>
....@@ -369,6 +370,7 @@
369370 	if (type <= 0 || type > maxtype)
370371 		return 0;
371372 
373
+	type = array_index_nospec(type, maxtype + 1);
372374 	pt = &policy[type];
373375 
374376 	BUG_ON(pt->type > NLA_TYPE_MAX);
....@@ -584,6 +586,7 @@
584586 			}
585587 			continue;
586588 		}
589
+		type = array_index_nospec(type, maxtype + 1);
587590 		if (policy) {
588591 			int err = validate_nla(nla, maxtype, policy,
589592 					       validate, extack, depth);