tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

[AX.25]: Fix potencial memory hole.

If the AX.25 dialect chosen by the sysadmin is set to DAMA master / 3
(or DAMA slave / 2, if CONFIG_AX25_DAMA_SLAVE=n) ax25_kick() will fall
through the switch statement without calling ax25_send_iframe() or any
other function that would eventually free skbn thus leaking the packet.

Fix by restricting the sysctl inferface to allow only actually supported
AX.25 dialects.

The system administration mistake needed for this to happen is rather
unlikely, so this is an uncritical hole.

Coverity #651.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Ralf Baechle DL5RB and committed by
David S. Miller c7c694d1 60a6dc55

+9 -2
+8 -1
include/net/ax25.h
··· 110 110 enum { 111 111 AX25_PROTO_STD_SIMPLEX, 112 112 AX25_PROTO_STD_DUPLEX, 113 + #ifdef CONFIG_AX25_DAMA_SLAVE 113 114 AX25_PROTO_DAMA_SLAVE, 114 - AX25_PROTO_DAMA_MASTER 115 + #ifdef CONFIG_AX25_DAMA_MASTER 116 + AX25_PROTO_DAMA_MASTER, 117 + #define AX25_PROTO_MAX AX25_PROTO_DAMA_MASTER 118 + #endif 119 + #endif 120 + __AX25_PROTO_MAX, 121 + AX25_PROTO_MAX = __AX25_PROTO_MAX -1 115 122 }; 116 123 117 124 enum {
+1 -1
net/ax25/sysctl_net_ax25.c
··· 24 24 static int min_idle[1], max_idle[] = {65535 * HZ}; 25 25 static int min_n2[] = {1}, max_n2[] = {31}; 26 26 static int min_paclen[] = {1}, max_paclen[] = {512}; 27 - static int min_proto[1], max_proto[] = {3}; 27 + static int min_proto[1], max_proto[] = { AX25_PROTO_MAX }; 28 28 static int min_ds_timeout[1], max_ds_timeout[] = {65535 * HZ}; 29 29 30 30 static struct ctl_table_header *ax25_table_header;