1 files changed, 11 insertions, 0 deletions

diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index c591212793ee..e4d7bed99c2e 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -72,6 +72,17 @@ static int validate_nla(struct nlattr *nla, int maxtype,
                         return -ERANGE;
                 break;
 
+        case NLA_NESTED_COMPAT:
+                if (attrlen < pt->len)
+                        return -ERANGE;
+                if (attrlen < NLA_ALIGN(pt->len))
+                        break;
+                if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN)
+                        return -ERANGE;
+                nla = nla_data(nla) + NLA_ALIGN(pt->len);
+                if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN + nla_len(nla))
+                        return -ERANGE;
+                break;
         default:
                 if (pt->len)
                         minlen = pt->len;