1 files changed, 19 insertions, 5 deletions

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index e3219e4cd044..9796f3ed1edb 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -55,6 +55,7 @@
 #include <linux/notifier.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/ctype.h>
 
 #include <net/x25.h>
 #include <net/compat.h>
@@ -512,15 +513,20 @@ static int x25_create(struct net *net, struct socket *sock, int protocol,
 {
         struct sock *sk;
         struct x25_sock *x25;
-        int rc = -ESOCKTNOSUPPORT;
+        int rc = -EAFNOSUPPORT;
 
         if (!net_eq(net, &init_net))
-                return -EAFNOSUPPORT;
+                goto out;
 
-        if (sock->type != SOCK_SEQPACKET || protocol)
+        rc = -ESOCKTNOSUPPORT;
+        if (sock->type != SOCK_SEQPACKET)
                 goto out;
 
-        rc = -ENOMEM;
+        rc = -EINVAL;
+        if (protocol)
+                goto out;
+
+        rc = -ENOBUFS;
         if ((sk = x25_alloc_socket(net)) == NULL)
                 goto out;
 
@@ -643,7 +649,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
-        int rc = 0;
+        int len, i, rc = 0;
 
         lock_kernel();
         if (!sock_flag(sk, SOCK_ZAPPED) ||
@@ -653,6 +659,14 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
+        len = strlen(addr->sx25_addr.x25_addr);
+        for (i = 0; i < len; i++) {
+                if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
+
         x25_sk(sk)->source_addr = addr->sx25_addr;
         x25_insert_socket(sk);
         sock_reset_flag(sk, SOCK_ZAPPED);