[AX25]: UID fixes

 o Brown paperbag bug - ax25_findbyuid() was always returning a NULL pointer
   as the result.  Breaks ROSE completly and AX.25 if UID policy set to deny.

 o While the list structure of AX.25's UID to callsign mapping table was
   properly protected by a spinlock, it's elements were not refcounted
   resulting in a race between removal and usage of an element.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 12 insertions, 8 deletions

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 7d8ecadba668..a5c94f11547c 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1002,7 +1002,8 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sock *sk = sock->sk;
         struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
         ax25_dev *ax25_dev = NULL;
-        ax25_address *call;
+        ax25_uid_assoc *user;
+        ax25_address call;
         ax25_cb *ax25;
         int err = 0;
 
@@ -1021,9 +1022,15 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr->fsa_ax25.sax25_family != AF_AX25)
                 return -EINVAL;
 
-        call = ax25_findbyuid(current->euid);
-        if (call == NULL && ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
-                return -EACCES;
+        user = ax25_findbyuid(current->euid);
+        if (user) {
+                call = user->call;
+                ax25_uid_put(user);
+        } else {
+                if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                call = addr->fsa_ax25.sax25_call;
         }
 
         lock_sock(sk);
@@ -1034,10 +1041,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
-        if (call == NULL)
-                ax25->source_addr = addr->fsa_ax25.sax25_call;
-        else
-                ax25->source_addr = *call;
+        ax25->source_addr = call;
 
         /*
          * User already set interface with SO_BINDTODEVICE