6 files changed, 53 insertions, 20 deletions

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c2397f503b0f..f38cc5317b88 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 
 void __exit br_cleanup_bridges(void)
 {
-        struct net_device *dev, *nxt;
+        struct net_device *dev;
 
         rtnl_lock();
-        for_each_netdev_safe(&init_net, dev, nxt)
-                if (dev->priv_flags & IFF_EBRIDGE)
+restart:
+        for_each_netdev(&init_net, dev) {
+                if (dev->priv_flags & IFF_EBRIDGE) {
                         del_br(dev->priv);
+                        goto restart;
+                }
+        }
         rtnl_unlock();
 
 }
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7e8ca2836452..484bbf6dd032 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
  *  -ENOBUFS on full driver queue (see net_xmit_errno())
  *  -ENOMEM when local loopback failed at calling skb_clone()
  *  -EPERM when trying to send on a non-CAN interface
+ *  -EINVAL when the skb->data does not contain a valid CAN frame
  */
 int can_send(struct sk_buff *skb, int loop)
 {
         struct sk_buff *newskb = NULL;
+        struct can_frame *cf = (struct can_frame *)skb->data;
         int err;
 
+        if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
         if (skb->dev->type != ARPHRD_CAN) {
                 kfree_skb(skb);
                 return -EPERM;
@@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pt, struct net_device *orig_dev)
 {
         struct dev_rcv_lists *d;
+        struct can_frame *cf = (struct can_frame *)skb->data;
         int matches;
 
         if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) {
@@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                 return 0;
         }
 
+        BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
+
         /* update statistics */
         can_stats.rx_frames++;
         can_stats.rx_frames_delta++;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d9a3a9d13bed..72c2ce904f83 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -298,7 +298,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
 
         if (head->nframes) {
                 /* can_frames starting here */
-                firstframe = (struct can_frame *) skb_tail_pointer(skb);
+                firstframe = (struct can_frame *)skb_tail_pointer(skb);
 
                 memcpy(skb_put(skb, datalen), frames, datalen);
 
@@ -826,6 +826,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 for (i = 0; i < msg_head->nframes; i++) {
                         err = memcpy_fromiovec((u8 *)&op->frames[i],
                                                msg->msg_iov, CFSIZ);
+
+                        if (op->frames[i].can_dlc > 8)
+                                err = -EINVAL;
+
                         if (err < 0)
                                 return err;
 
@@ -858,6 +862,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 for (i = 0; i < msg_head->nframes; i++) {
                         err = memcpy_fromiovec((u8 *)&op->frames[i],
                                                msg->msg_iov, CFSIZ);
+
+                        if (op->frames[i].can_dlc > 8)
+                                err = -EINVAL;
+
                         if (err < 0) {
                                 if (op->frames != &op->sframe)
                                         kfree(op->frames);
@@ -1164,9 +1172,12 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
 
         skb->dev = dev;
         skb->sk  = sk;
-        can_send(skb, 1); /* send with loopback */
+        err = can_send(skb, 1); /* send with loopback */
         dev_put(dev);
 
+        if (err)
+                return err;
+
         return CFSIZ + MHSIZ;
 }
 
@@ -1185,6 +1196,10 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (!bo->bound)
                 return -ENOTCONN;
 
+        /* check for valid message length from userspace */
+        if (size < MHSIZ || (size - MHSIZ) % CFSIZ)
+                return -EINVAL;
+
         /* check for alternative ifindex for this bcm_op */
 
         if (!ifindex && msg->msg_name) {
@@ -1259,8 +1274,8 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
                 break;
 
         case TX_SEND:
-                /* we need at least one can_frame */
-                if (msg_head.nframes < 1)
+                /* we need exactly one can_frame behind the msg head */
+                if ((msg_head.nframes != 1) || (size != CFSIZ + MHSIZ))
                         ret = -EINVAL;
                 else
                         ret = bcm_tx_send(msg, ifindex, sk);
diff --git a/net/can/raw.c b/net/can/raw.c
index 69877b8e7e9c..3e46ee36a1aa 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -632,6 +632,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
         } else
                 ifindex = ro->ifindex;
 
+        if (size != sizeof(struct can_frame))
+                return -EINVAL;
+
         dev = dev_get_by_index(&init_net, ifindex);
         if (!dev)
                 return -ENXIO;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 850825dc86e6..1d723de18686 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -255,6 +255,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/skbuff.h>
+#include <linux/scatterlist.h>
 #include <linux/splice.h>
 #include <linux/net.h>
 #include <linux/socket.h>
@@ -1208,7 +1209,8 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                 return -ENOTCONN;
         while ((skb = tcp_recv_skb(sk, seq, &offset)) != NULL) {
                 if (offset < skb->len) {
-                        size_t used, len;
+                        int used;
+                        size_t len;
 
                         len = skb->len - offset;
                         /* Stop reading if we hit a patch of urgent data */
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 0517967a68bf..e6fb21b19b86 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -243,10 +243,10 @@ int rpcb_getport_sync(struct sockaddr_in *sin, u32 prog, u32 vers, int prot)
 }
 EXPORT_SYMBOL_GPL(rpcb_getport_sync);
 
-static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbind_args *map, int version)
+static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbind_args *map, struct rpc_procinfo *proc)
 {
         struct rpc_message msg = {
-                .rpc_proc = rpcb_next_version[version].rpc_proc,
+                .rpc_proc = proc,
                 .rpc_argp = map,
                 .rpc_resp = &map->r_port,
         };
@@ -271,6 +271,7 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
 void rpcb_getport_async(struct rpc_task *task)
 {
         struct rpc_clnt *clnt = task->tk_client;
+        struct rpc_procinfo *proc;
         u32 bind_version;
         struct rpc_xprt *xprt = task->tk_xprt;
         struct rpc_clnt *rpcb_clnt;
@@ -280,7 +281,6 @@ void rpcb_getport_async(struct rpc_task *task)
         struct sockaddr *sap = (struct sockaddr *)&addr;
         size_t salen;
         int status;
-        struct rpcb_info *info;
 
         dprintk("RPC: %5u %s(%s, %u, %u, %d)\n",
                 task->tk_pid, __func__,
@@ -313,10 +313,12 @@ void rpcb_getport_async(struct rpc_task *task)
         /* Don't ever use rpcbind v2 for AF_INET6 requests */
         switch (sap->sa_family) {
         case AF_INET:
-                info = rpcb_next_version;
+                proc = rpcb_next_version[xprt->bind_index].rpc_proc;
+                bind_version = rpcb_next_version[xprt->bind_index].rpc_vers;
                 break;
         case AF_INET6:
-                info = rpcb_next_version6;
+                proc = rpcb_next_version6[xprt->bind_index].rpc_proc;
+                bind_version = rpcb_next_version6[xprt->bind_index].rpc_vers;
                 break;
         default:
                 status = -EAFNOSUPPORT;
@@ -324,14 +326,13 @@ void rpcb_getport_async(struct rpc_task *task)
                                 task->tk_pid, __func__);
                 goto bailout_nofree;
         }
-        if (info[xprt->bind_index].rpc_proc == NULL) {
+        if (proc == NULL) {
                 xprt->bind_index = 0;
                 status = -EPFNOSUPPORT;
                 dprintk("RPC: %5u %s: no more getport versions available\n",
                         task->tk_pid, __func__);
                 goto bailout_nofree;
         }
-        bind_version = info[xprt->bind_index].rpc_vers;
 
         dprintk("RPC: %5u %s: trying rpcbind version %u\n",
                 task->tk_pid, __func__, bind_version);
@@ -361,22 +362,20 @@ void rpcb_getport_async(struct rpc_task *task)
         map->r_addr = rpc_peeraddr2str(rpcb_clnt, RPC_DISPLAY_UNIVERSAL_ADDR);
         map->r_owner = RPCB_OWNER_STRING;       /* ignored for GETADDR */
 
-        child = rpcb_call_async(rpcb_clnt, map, xprt->bind_index);
+        child = rpcb_call_async(rpcb_clnt, map, proc);
         rpc_release_client(rpcb_clnt);
         if (IS_ERR(child)) {
                 status = -EIO;
+                /* rpcb_map_release() has freed the arguments */
                 dprintk("RPC: %5u %s: rpc_run_task failed\n",
                         task->tk_pid, __func__);
-                goto bailout;
+                goto bailout_nofree;
         }
         rpc_put_task(child);
 
         task->tk_xprt->stat.bind_count++;
         return;
 
-bailout:
-        kfree(map);
-        xprt_put(xprt);
 bailout_nofree:
         rpcb_wake_rpcbind_waiters(xprt, status);
 bailout_nowake: