1 files changed, 23 insertions, 4 deletions

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 524e826bb976..86bd8660a8f2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -886,6 +886,13 @@ retry:
         if (netlink_is_kernel(sk))
                 return netlink_unicast_kernel(sk, skb);
 
+        if (sk_filter(sk, skb)) {
+                int err = skb->len;
+                kfree_skb(skb);
+                sock_put(sk);
+                return err;
+        }
+
         err = netlink_attachskb(sk, skb, nonblock, &timeo, ssk);
         if (err == 1)
                 goto retry;
@@ -980,6 +987,9 @@ static inline int do_one_broadcast(struct sock *sk,
                 netlink_overrun(sk);
                 /* Clone failed. Notify ALL listeners. */
                 p->failure = 1;
+        } else if (sk_filter(sk, p->skb2)) {
+                kfree_skb(p->skb2);
+                p->skb2 = NULL;
         } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) {
                 netlink_overrun(sk);
         } else {
@@ -1533,8 +1543,13 @@ static int netlink_dump(struct sock *sk)
 
         if (len > 0) {
                 mutex_unlock(nlk->cb_mutex);
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, len);
+
+                if (sk_filter(sk, skb))
+                        kfree_skb(skb);
+                else {
+                        skb_queue_tail(&sk->sk_receive_queue, skb);
+                        sk->sk_data_ready(sk, skb->len);
+                }
                 return 0;
         }
 
@@ -1544,8 +1559,12 @@ static int netlink_dump(struct sock *sk)
 
         memcpy(nlmsg_data(nlh), &len, sizeof(len));
 
-        skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        if (sk_filter(sk, skb))
+                kfree_skb(skb);
+        else {
+                skb_queue_tail(&sk->sk_receive_queue, skb);
+                sk->sk_data_ready(sk, skb->len);
+        }
 
         if (cb->done)
                 cb->done(cb);