if ((type == 2 || type == 5) && (nlh->nlmsg_flags & NLM_F_DUMP)) { 
if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && (nlh->nlmsg_flags & NLM_F_DUMP)) { 
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp){	struct rtattr *xfrma[XFRMA_MAX];	struct xfrm_link *link;	int type, min_len;	if (!(nlh->nlmsg_flags & NLM_F_REQUEST))		return 0;	type = nlh->nlmsg_type;	/* A control message: ignore them */	if (type < XFRM_MSG_BASE)		return 0;	/* Unknown message: reply with EINVAL */	if (type > XFRM_MSG_MAX)		goto err_einval;	type -= XFRM_MSG_BASE;	link = &xfrm_dispatch[type];	/* All operations require privileges, even GET */	if (security_netlink_recv(skb)) {		*errp = -EPERM;		return -1;	}	if ((type == 2 || type == 5) && (nlh->nlmsg_flags & NLM_F_DUMP)) {		u32 rlen;		if (link->dump == NULL)			goto err_einval;		if ((*errp = netlink_dump_start(xfrm_nl, skb, nlh,						link->dump,						xfrm_done)) != 0) {			return -1;		}		rlen = NLMSG_ALIGN(nlh->nlmsg_len);		if (rlen > skb->len)			rlen = skb->len;		skb_pull(skb, rlen);		return -1;	}	memset(xfrma, 0, sizeof(xfrma));	if (nlh->nlmsg_len < (min_len = xfrm_msg_min[type]))		goto err_einval;	if (nlh->nlmsg_len > min_len) {		int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);		struct rtattr *attr = (void *) nlh + NLMSG_ALIGN(min_len);		while (RTA_OK(attr, attrlen)) {			unsigned short flavor = attr->rta_type;			if (flavor) {				if (flavor > XFRMA_MAX)					goto err_einval;				xfrma[flavor - 1] = attr;			}			attr = RTA_NEXT(attr, attrlen);		}	}	if (link->doit == NULL)		goto err_einval;	*errp = link->doit(skb, nlh, (void **) &xfrma);	return *errp;err_einval:	*errp = -EINVAL;	return -1;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/492b558b3191319cbc859a9e025bc354d336c261/xfrm_user.c/buggy/net/xfrm/xfrm_user.c