--- net/ipv4/inet_diag.c

+++ net/ipv4/inet_diag.c

@@ -489,9 +489,11 @@ static int inet_csk_diag_dump(struct soc

{

struct inet_diag_req *r = NLMSG_DATA(cb->nlh);

- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {

+ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {

struct inet_diag_entry entry;

- struct rtattr *bc = (struct rtattr *)(r + 1);

+ const struct nlattr *bc = nlmsg_find_attr(cb->nlh,

+ sizeof(*r),

+ INET_DIAG_REQ_BYTECODE);

struct inet_sock *inet = inet_sk(sk);

entry.family = sk->sk_family;

@@ -511,7 +513,7 @@ static int inet_csk_diag_dump(struct soc

entry.dport = ntohs(inet->dport);

entry.userlocks = sk->sk_userlocks;

- if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))

+ if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))

return 0;

}

@@ -526,9 +528,11 @@ static int inet_twsk_diag_dump(struct in

{

struct inet_diag_req *r = NLMSG_DATA(cb->nlh);

- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {

+ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {

struct inet_diag_entry entry;

- struct rtattr *bc = (struct rtattr *)(r + 1);

+ const struct nlattr *bc = nlmsg_find_attr(cb->nlh,

+ sizeof(*r),

+ INET_DIAG_REQ_BYTECODE);

entry.family = tw->tw_family;

#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)

@@ -547,7 +551,7 @@ static int inet_twsk_diag_dump(struct in

entry.dport = ntohs(tw->tw_dport);

entry.userlocks = 0;

- if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))

+ if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))

return 0;

}

@@ -617,7 +621,7 @@ static int inet_diag_dump_reqs(struct sk

struct inet_diag_req *r = NLMSG_DATA(cb->nlh);

struct inet_connection_sock *icsk = inet_csk(sk);

struct listen_sock *lopt;

- struct rtattr *bc = NULL;

+ const struct nlattr *bc = NULL;

struct inet_sock *inet = inet_sk(sk);

int j, s_j;

int reqnum, s_reqnum;

@@ -637,8 +641,9 @@ static int inet_diag_dump_reqs(struct sk

if (!lopt || !lopt->qlen)

goto out;

- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {

- bc = (struct rtattr *)(r + 1);

+ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {

+ bc = nlmsg_find_attr(cb->nlh, sizeof(*r),

+ INET_DIAG_REQ_BYTECODE);

entry.sport = inet->num;

entry.userlocks = sk->sk_userlocks;

}

@@ -671,8 +676,8 @@ static int inet_diag_dump_reqs(struct sk

&ireq->rmt_addr;

entry.dport = ntohs(ireq->rmt_port);

- if (!inet_diag_bc_run(RTA_DATA(bc),

- RTA_PAYLOAD(bc), &entry))

+ if (!inet_diag_bc_run(nla_data(bc),

+ nla_len(bc), &entry))

continue;

}