1 files changed, 7 insertions, 4 deletions

diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index d86030ef1232..e135d4e11231 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -55,6 +55,7 @@ struct tipc_nl_compat_msg {
         int rep_type;
         int rep_size;
         int req_type;
+        int req_size;
         struct net *net;
         struct sk_buff *rep;
         struct tlv_desc *req;
@@ -257,7 +258,8 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         int err;
         struct sk_buff *arg;
 
-        if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
+        if (msg->req_type && (!msg->req_size ||
+                              !TLV_CHECK_TYPE(msg->req, msg->req_type)))
                 return -EINVAL;
 
         msg->rep = tipc_tlv_alloc(msg->rep_size);
@@ -354,7 +356,8 @@ static int tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
 {
         int err;
 
-        if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
+        if (msg->req_type && (!msg->req_size ||
+                              !TLV_CHECK_TYPE(msg->req, msg->req_type)))
                 return -EINVAL;
 
         err = __tipc_nl_compat_doit(cmd, msg);
@@ -1278,8 +1281,8 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
                 goto send;
         }
 
-        len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
-        if (!len || !TLV_OK(msg.req, len)) {
+        msg.req_size = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
+        if (msg.req_size && !TLV_OK(msg.req, msg.req_size)) {
                 msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
                 err = -EOPNOTSUPP;
                 goto send;