Patchwork [3.5.y.z,extended,stable] Patch "rtnetlink: Mask the rta_type when range checking" has been added to staging queue

mail settings
Submitter Luis Henriques
Date March 25, 2013, 6:04 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/230943/
State New
Headers show


Luis Henriques - March 25, 2013, 6:04 p.m.
This is a note to let you know that I have just added a patch titled

    rtnetlink: Mask the rta_type when range checking

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 68003a9df4969932ae14ce3e5cb6c3eb7b80847d Mon Sep 17 00:00:00 2001
From: Vlad Yasevich <>
Date: Wed, 13 Mar 2013 04:18:58 +0000
Subject: [PATCH] rtnetlink: Mask the rta_type when range checking

commit a5b8db91442fce9c9713fcd656c3698f1adde1d6 upstream.

Range/validity checks on rta_type in rtnetlink_rcv_msg() do
not account for flags that may be set.  This causes the function
to return -EINVAL when flags are set on the type (for example

Signed-off-by: Vlad Yasevich <>
Acked-by: Thomas Graf <>
Signed-off-by: David S. Miller <>
Signed-off-by: Luis Henriques <>
 net/core/rtnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 8f37bec..844ccc6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2317,7 +2317,7 @@  static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 		struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);

 		while (RTA_OK(attr, attrlen)) {
-			unsigned int flavor = attr->rta_type;
+			unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
 			if (flavor) {
 				if (flavor > rta_max[sz_idx])
 					return -EINVAL;