btrfs: fix race between quota disable and quota assign ioctls

[platform/kernel/linux-rpi.git] / lib / nlattr.c

diff --git a/lib/nlattr.c b/lib/nlattr.c
index 86029ad..73635bd 100644 (file)
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/jiffies.h>
+#include <linux/nospec.h>
 #include <linux/skbuff.h>
 #include <linux/string.h>
 #include <linux/types.h>
@@ -369,6 +370,7 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
        if (type <= 0 || type > maxtype)
                return 0;
 
+       type = array_index_nospec(type, maxtype + 1);
        pt = &policy[type];
 
        BUG_ON(pt->type > NLA_TYPE_MAX);
@@ -584,6 +586,7 @@ static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype,
                        }
                        continue;
                }
+               type = array_index_nospec(type, maxtype + 1);
                if (policy) {
                        int err = validate_nla(nla, maxtype, policy,
                                               validate, extack, depth);