Commit 9eba2526 authored Nov 28, 2012 by Krzysztof Mazur Committed by David Woodhouse Dec 02, 2012

br2684: allow assign only on a connected socket



The br2684 does not check if used vcc is in connected state,
causing potential Oops in pppoatm_send() when vcc->send() is called
on not fully connected socket.

Now br2684 can be assigned only on connected sockets; otherwise
-EINVAL error is returned.

Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

parent 007ef52b

net/atm/br2684.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -735,10 +735,13 @@ static int br2684_ioctl(struct socket *sock, unsigned int cmd,
		return -ENOIOCTLCMD;
		if (!capable(CAP_NET_ADMIN))
		return -EPERM;
		if (cmd == ATM_SETBACKEND)
		if (cmd == ATM_SETBACKEND) {
		if (sock->state != SS_CONNECTED)
		return -EINVAL;
		return br2684_regvcc(atmvcc, argp);
		else
		} else {
		return br2684_create(argp);
		}
		#ifdef CONFIG_ATM_BR2684_IPFILTER
		case BR2684_SETFILT:
		if (atmvcc->push != br2684_push)