2 files changed, 21 insertions, 1 deletions

diff --git a/include/linux/filter.h b/include/linux/filter.h
index b6ea9aa9e853..1354aaf6abbe 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -122,7 +122,8 @@ struct sock_fprog	/* Required for SO_ATTACH_FILTER. */
 #define SKF_AD_PKTTYPE  4
 #define SKF_AD_IFINDEX  8
 #define SKF_AD_NLATTR   12
-#define SKF_AD_MAX      16
+#define SKF_AD_NLATTR_NEST      16
+#define SKF_AD_MAX      20
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
 
diff --git a/net/core/filter.c b/net/core/filter.c
index df3744355839..d1d779ca096d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -319,6 +319,25 @@ load_b:
                                 A = 0;
                         continue;
                 }
+                case SKF_AD_NLATTR_NEST: {
+                        struct nlattr *nla;
+
+                        if (skb_is_nonlinear(skb))
+                                return 0;
+                        if (A > skb->len - sizeof(struct nlattr))
+                                return 0;
+
+                        nla = (struct nlattr *)&skb->data[A];
+                        if (nla->nla_len > A - skb->len)
+                                return 0;
+
+                        nla = nla_find_nested(nla, X);
+                        if (nla)
+                                A = (void *)nla - (void *)skb->data;
+                        else
+                                A = 0;
+                        continue;
+                }
                 default:
                         return 0;
                 }