2 files changed, 4 insertions, 0 deletions

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 6608db23f54b..f3c89ccf14c5 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -717,6 +717,8 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
                         nla_strlcpy(tmp, nla, sizeof(tmp));
                         val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca);
                 } else {
+                        if (nla_len(nla) != sizeof(u32))
+                                return false;
                         val = nla_get_u32(nla);
                 }
 
diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index 5121c6475e6b..04311f7067e2 100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -32,6 +32,8 @@ int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, int fc_mx_len,
                         if (val == TCP_CA_UNSPEC)
                                 return -EINVAL;
                 } else {
+                        if (nla_len(nla) != sizeof(u32))
+                                return -EINVAL;
                         val = nla_get_u32(nla);
                 }
                 if (type == RTAX_ADVMSS && val > 65535 - 40)