[AF_NETLINK]: Fix DoS in netlink_rcv_skb()

From: Martin Murray <[e-mail]>

Sanity check nlmsg_len during netlink_rcv_skb. An nlmsg_len == 0 can
cause infinite loop in kernel, effectively DoSing machine. Noted by
Matin Murray.

Signed-off-by: Chris Wright <[e-mail]>
Signed-off-by: David S. Miller <[e-mail]>

net/netlink/af_netlink.c

···
 	while (skb->len >= nlmsg_total_size(0)) {
 		nlh = (struct nlmsghdr *) skb->data;
 
-		if (skb->len < nlh->nlmsg_len)
+		if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
 			return 0;
 
 		total_len = min(NLMSG_ALIGN(nlh->nlmsg_len), skb->len);