dccp qpolicy: Parameter checking of cmsg qpolicy parameters

Ensure that cmsg->cmsg_type value is valid for qpolicy
that is currently in use.

Signed-off-by: Tomasz Grobelny <tomasz@grobelny.oswiecenia.net>
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>

1 files changed, 4 insertions, 0 deletions

diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index d6a224982bb5..152975d942d9 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -726,6 +726,10 @@ static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
                 if (cmsg->cmsg_level != SOL_DCCP)
                         continue;
 
+                if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
+                    !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
+                        return -EINVAL;
+
                 switch (cmsg->cmsg_type) {
                 case DCCP_SCM_PRIORITY:
                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))