summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKrzysztof Mazur <krzysiek@podlesie.net>2012-11-28 09:08:04 +0100
committerDavid Woodhouse <David.Woodhouse@intel.com>2012-12-02 01:05:19 +0100
commit9eba25268e5862571d53122065616c456fe1142a (patch)
tree30c5053cd10de8dc4c75825d62f89e183e911247
parentsolos-pci: Fix leak of skb received for unknown vcc (diff)
downloadlinux-9eba25268e5862571d53122065616c456fe1142a.tar.xz
linux-9eba25268e5862571d53122065616c456fe1142a.zip
br2684: allow assign only on a connected socket
The br2684 does not check if used vcc is in connected state, causing potential Oops in pppoatm_send() when vcc->send() is called on not fully connected socket. Now br2684 can be assigned only on connected sockets; otherwise -EINVAL error is returned. Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
-rw-r--r--net/atm/br2684.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 6dc383c90262..403e71fa88fe 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -735,10 +735,13 @@ static int br2684_ioctl(struct socket *sock, unsigned int cmd,
return -ENOIOCTLCMD;
if (!capable(CAP_NET_ADMIN))
return -EPERM;
- if (cmd == ATM_SETBACKEND)
+ if (cmd == ATM_SETBACKEND) {
+ if (sock->state != SS_CONNECTED)
+ return -EINVAL;
return br2684_regvcc(atmvcc, argp);
- else
+ } else {
return br2684_create(argp);
+ }
#ifdef CONFIG_ATM_BR2684_IPFILTER
case BR2684_SETFILT:
if (atmvcc->push != br2684_push)