[IPV6]: Verify nlmsg_len in rt6_dump_route().

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6711d91692737c08d3a5f1fac7ba784eade7d5e9..4c5e714a7da7fb1a963e611510edbeac95cf1a92 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1558,13 +1558,13 @@ rtattr_failure:
 static int rt6_dump_route(struct rt6_info *rt, void *p_arg)
 {
        struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg;
-       struct rtmsg *rtm;
        int prefix;
 
-       rtm = NLMSG_DATA(arg->cb->nlh);
-       if (rtm)
+       if (arg->cb->nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(struct rtmsg))) {
+               struct rtmsg *rtm = NLMSG_DATA(arg->cb->nlh);
                prefix = (rtm->rtm_flags & RTM_F_PREFIX) != 0;
-       else prefix = 0;
+       } else
+               prefix = 0;
 
        return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
                     NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,