aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRalf Baechle DL5RB <ralf@linux-mips.org>2006-03-19 16:20:06 -0500
committerDavid S. Miller <davem@davemloft.net>2006-03-19 16:20:06 -0500
commitc7c694d196a39af6e644e24279953d04f30362db (patch)
treecb78fead47ce86245179fe0a52119c70b30b59cb
parent60a6dc55b93b3321afa52f650a149fb7e87fa85a (diff)
[AX.25]: Fix potencial memory hole.
If the AX.25 dialect chosen by the sysadmin is set to DAMA master / 3 (or DAMA slave / 2, if CONFIG_AX25_DAMA_SLAVE=n) ax25_kick() will fall through the switch statement without calling ax25_send_iframe() or any other function that would eventually free skbn thus leaking the packet. Fix by restricting the sysctl inferface to allow only actually supported AX.25 dialects. The system administration mistake needed for this to happen is rather unlikely, so this is an uncritical hole. Coverity #651. Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--include/net/ax25.h9
-rw-r--r--net/ax25/sysctl_net_ax25.c2
2 files changed, 9 insertions, 2 deletions
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 2250a18b0cbb..d052b221dbcd 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -110,8 +110,15 @@ enum {
110enum { 110enum {
111 AX25_PROTO_STD_SIMPLEX, 111 AX25_PROTO_STD_SIMPLEX,
112 AX25_PROTO_STD_DUPLEX, 112 AX25_PROTO_STD_DUPLEX,
113#ifdef CONFIG_AX25_DAMA_SLAVE
113 AX25_PROTO_DAMA_SLAVE, 114 AX25_PROTO_DAMA_SLAVE,
114 AX25_PROTO_DAMA_MASTER 115#ifdef CONFIG_AX25_DAMA_MASTER
116 AX25_PROTO_DAMA_MASTER,
117#define AX25_PROTO_MAX AX25_PROTO_DAMA_MASTER
118#endif
119#endif
120 __AX25_PROTO_MAX,
121 AX25_PROTO_MAX = __AX25_PROTO_MAX -1
115}; 122};
116 123
117enum { 124enum {
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f67711f2ee96..894a22558d9d 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -24,7 +24,7 @@ static int min_t3[1], max_t3[] = {3600 * HZ};
24static int min_idle[1], max_idle[] = {65535 * HZ}; 24static int min_idle[1], max_idle[] = {65535 * HZ};
25static int min_n2[] = {1}, max_n2[] = {31}; 25static int min_n2[] = {1}, max_n2[] = {31};
26static int min_paclen[] = {1}, max_paclen[] = {512}; 26static int min_paclen[] = {1}, max_paclen[] = {512};
27static int min_proto[1], max_proto[] = {3}; 27static int min_proto[1], max_proto[] = { AX25_PROTO_MAX };
28static int min_ds_timeout[1], max_ds_timeout[] = {65535 * HZ}; 28static int min_ds_timeout[1], max_ds_timeout[] = {65535 * HZ};
29 29
30static struct ctl_table_header *ax25_table_header; 30static struct ctl_table_header *ax25_table_header;