Merge tag 'v5.2' into perf/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

1 files changed, 15 insertions, 3 deletions

diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index c6a04c09d075..cf155061c472 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -445,7 +445,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
@@ -539,7 +543,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
 
         name = (char *)TLV_DATA(msg->req);
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
@@ -817,7 +825,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
         if (!link)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;