Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit deb507f9 authored by Oliver Hartkopp's avatar Oliver Hartkopp Committed by Marc Kleine-Budde
Browse files

can: bcm: fix warning in bcm_connect/proc_register 

Andrey Konovalov reported an issue with proc_register in bcm.c.
As suggested by Cong Wang this patch adds a lock_sock() protection and
a check for unsuccessful proc_create_data() in bcm_connect().

Reference: http://marc.info/?l=linux-netdev&m=147732648731237



Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Suggested-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 460d2830

net/can/bcm.c

+23 −9
Original line number Diff line number Diff line
@@ -1549,24 +1549,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, 
	struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;

	struct sock *sk = sock->sk;

	struct bcm_sock *bo = bcm_sk(sk);

	int ret = 0;



	if (len < sizeof(*addr))

		return -EINVAL;



	if (bo->bound)

		return -EISCONN;

	lock_sock(sk);



	if (bo->bound) {

		ret = -EISCONN;

		goto fail;

	}



	/* bind a device to this socket */

	if (addr->can_ifindex) {

		struct net_device *dev;



		dev = dev_get_by_index(&init_net, addr->can_ifindex);

		if (!dev)

			return -ENODEV;



		if (!dev) {

			ret = -ENODEV;

			goto fail;

		}

		if (dev->type != ARPHRD_CAN) {

			dev_put(dev);

			return -ENODEV;

			ret = -ENODEV;

			goto fail;

		}



		bo->ifindex = dev->ifindex;
@@ -1577,17 +1584,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, 
		bo->ifindex = 0;

	}



	bo->bound = 1;



	if (proc_dir) {

		/* unique socket address as filename */

		sprintf(bo->procname, "%lu", sock_i_ino(sk));

		bo->bcm_proc_read = proc_create_data(bo->procname, 0644,

						     proc_dir,

						     &bcm_proc_fops, sk);

		if (!bo->bcm_proc_read) {

			ret = -ENOMEM;

			goto fail;

		}

	}



	return 0;

	bo->bound = 1;



fail:

	release_sock(sk);



	return ret;

}



static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,