1 files changed, 28 insertions, 13 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 63ce2283a456..37c7936124e6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1898,10 +1898,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                 if (tb[IFLA_IF_NETNSID]) {
                         netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
                         tgt_net = get_target_net(skb->sk, netnsid);
-                        if (IS_ERR(tgt_net)) {
-                                tgt_net = net;
-                                netnsid = -1;
-                        }
+                        if (IS_ERR(tgt_net))
+                                return PTR_ERR(tgt_net);
                 }
 
                 if (tb[IFLA_EXT_MASK])
@@ -2837,6 +2835,12 @@ struct net_device *rtnl_create_link(struct net *net,
         else if (ops->get_num_rx_queues)
                 num_rx_queues = ops->get_num_rx_queues();
 
+        if (num_tx_queues < 1 || num_tx_queues > 4096)
+                return ERR_PTR(-EINVAL);
+
+        if (num_rx_queues < 1 || num_rx_queues > 4096)
+                return ERR_PTR(-EINVAL);
+
         dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type,
                                ops->setup, num_tx_queues, num_rx_queues);
         if (!dev)
@@ -3744,16 +3748,27 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int err = 0;
         int fidx = 0;
 
-        err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
-                          IFLA_MAX, ifla_policy, NULL);
-        if (err < 0) {
-                return -EINVAL;
-        } else if (err == 0) {
-                if (tb[IFLA_MASTER])
-                        br_idx = nla_get_u32(tb[IFLA_MASTER]);
-        }
+        /* A hack to preserve kernel<->userspace interface.
+         * Before Linux v4.12 this code accepted ndmsg since iproute2 v3.3.0.
+         * However, ndmsg is shorter than ifinfomsg thus nlmsg_parse() bails.
+         * So, check for ndmsg with an optional u32 attribute (not used here).
+         * Fortunately these sizes don't conflict with the size of ifinfomsg
+         * with an optional attribute.
+         */
+        if (nlmsg_len(cb->nlh) != sizeof(struct ndmsg) &&
+            (nlmsg_len(cb->nlh) != sizeof(struct ndmsg) +
+             nla_attr_size(sizeof(u32)))) {
+                err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+                                  IFLA_MAX, ifla_policy, NULL);
+                if (err < 0) {
+                        return -EINVAL;
+                } else if (err == 0) {
+                        if (tb[IFLA_MASTER])
+                                br_idx = nla_get_u32(tb[IFLA_MASTER]);
+                }
 
-        brport_idx = ifm->ifi_index;
+                brport_idx = ifm->ifi_index;
+        }
 
         if (br_idx) {
                 br_dev = __dev_get_by_index(net, br_idx);