This condition doesn't work when len is smaller than expected and not a
multiple of 4. In that situation "len - pos" is negative and type
promoted to a high unsigned value and we do not break out of the loop.
It causes the program calling it to crash.
Fixes: b42be38b2778 ('netlink: add API to retrieve all group memberships')
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 59651af..76a8466 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2373,7 +2373,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
err = 0;
netlink_lock_table();
for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
- if (len - pos < sizeof(u32))
+ if (len < pos + sizeof(u32))
break;
idx = pos / sizeof(unsigned long);
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
