2 files changed, 12 insertions, 8 deletions

diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index d9f487d813c4..a1e5619b1876 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -745,6 +745,10 @@ static inline int meta_is_supported(struct meta_value *val)
         return (!meta_id(val) || meta_ops(val)->get);
 }
 
+static const struct nla_policy meta_policy[TCA_EM_META_MAX + 1] = {
+        [TCA_EM_META_HDR]       = { .len = sizeof(struct tcf_meta_hdr) },
+};
+
 static int em_meta_change(struct tcf_proto *tp, void *data, int len,
                           struct tcf_ematch *m)
 {
@@ -753,13 +757,12 @@ static int em_meta_change(struct tcf_proto *tp, void *data, int len,
         struct tcf_meta_hdr *hdr;
         struct meta_match *meta = NULL;
 
-        err = nla_parse(tb, TCA_EM_META_MAX, data, len, NULL);
+        err = nla_parse(tb, TCA_EM_META_MAX, data, len, meta_policy);
         if (err < 0)
                 goto errout;
 
         err = -EINVAL;
-        if (tb[TCA_EM_META_HDR] == NULL ||
-            nla_len(tb[TCA_EM_META_HDR]) < sizeof(*hdr))
+        if (tb[TCA_EM_META_HDR] == NULL)
                 goto errout;
         hdr = nla_data(tb[TCA_EM_META_HDR]);
 
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index daa9c4e7e81d..74ff918455a2 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -282,6 +282,11 @@ errout:
         return err;
 }
 
+static const struct nla_policy em_policy[TCA_EMATCH_TREE_MAX + 1] = {
+        [TCA_EMATCH_TREE_HDR]   = { .len = sizeof(struct tcf_ematch_tree_hdr) },
+        [TCA_EMATCH_TREE_LIST]  = { .type = NLA_NESTED },
+};
+
 /**
  * tcf_em_tree_validate - validate ematch config TLV and build ematch tree
  *
@@ -312,7 +317,7 @@ int tcf_em_tree_validate(struct tcf_proto *tp, struct nlattr *nla,
                 return 0;
         }
 
-        err = nla_parse_nested(tb, TCA_EMATCH_TREE_MAX, nla, NULL);
+        err = nla_parse_nested(tb, TCA_EMATCH_TREE_MAX, nla, em_policy);
         if (err < 0)
                 goto errout;
 
@@ -323,10 +328,6 @@ int tcf_em_tree_validate(struct tcf_proto *tp, struct nlattr *nla,
         if (rt_hdr == NULL || rt_list == NULL)
                 goto errout;
 
-        if (nla_len(rt_hdr) < sizeof(*tree_hdr) ||
-            nla_len(rt_list) < sizeof(*rt_match))
-                goto errout;
-
         tree_hdr = nla_data(rt_hdr);
         memcpy(&tree->hdr, tree_hdr, sizeof(*tree_hdr));