Commit 5bd4e4c1 authored Mar 06, 2014 by Sasha Levin Committed by David S. Miller Mar 06, 2014

bonding: correctly handle out of range parameters for lp_interval



We didn't correctly check cases where the value for lp_interval is not
within the legal range due to a missing table terminator.

This would let userspace trigger a kernel panic by specifying a value out
of range:

	echo -1 > /sys/devices/virtual/net/bond0/bonding/lp_interval

Introduced by commit 4325b374 ("bonding: convert lp_interval to use
the new option API").

Acked-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d2d273ff

drivers/net/bonding/bond_options.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -121,6 +121,7 @@ static struct bond_opt_value bond_resend_igmp_tbl[] = {
	static struct bond_opt_value bond_lp_interval_tbl[] = {		static struct bond_opt_value bond_lp_interval_tbl[] = {
	{ "minval", 1, BOND_VALFLAG_MIN \| BOND_VALFLAG_DEFAULT},		{ "minval", 1, BOND_VALFLAG_MIN \| BOND_VALFLAG_DEFAULT},
	{ "maxval", INT_MAX, BOND_VALFLAG_MAX},		{ "maxval", INT_MAX, BOND_VALFLAG_MAX},
			{ NULL, -1, 0},
	};		};

	static struct bond_option bond_opts[] = {		static struct bond_option bond_opts[] = {