Commit c7c694d1 authored by Ralf Baechle DL5RB's avatar Ralf Baechle DL5RB Committed by David S. Miller

[AX.25]: Fix potencial memory hole.

If the AX.25 dialect chosen by the sysadmin is set to DAMA master / 3
(or DAMA slave / 2, if CONFIG_AX25_DAMA_SLAVE=n) ax25_kick() will fall
through the switch statement without calling ax25_send_iframe() or any
other function that would eventually free skbn thus leaking the packet.

Fix by restricting the sysctl inferface to allow only actually supported
AX.25 dialects.

The system administration mistake needed for this to happen is rather
unlikely, so this is an uncritical hole.

Coverity #651.
Signed-off-by: default avatarRalf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 60a6dc55
...@@ -110,8 +110,15 @@ enum { ...@@ -110,8 +110,15 @@ enum {
enum { enum {
AX25_PROTO_STD_SIMPLEX, AX25_PROTO_STD_SIMPLEX,
AX25_PROTO_STD_DUPLEX, AX25_PROTO_STD_DUPLEX,
#ifdef CONFIG_AX25_DAMA_SLAVE
AX25_PROTO_DAMA_SLAVE, AX25_PROTO_DAMA_SLAVE,
AX25_PROTO_DAMA_MASTER #ifdef CONFIG_AX25_DAMA_MASTER
AX25_PROTO_DAMA_MASTER,
#define AX25_PROTO_MAX AX25_PROTO_DAMA_MASTER
#endif
#endif
__AX25_PROTO_MAX,
AX25_PROTO_MAX = __AX25_PROTO_MAX -1
}; };
enum { enum {
......
...@@ -24,7 +24,7 @@ static int min_t3[1], max_t3[] = {3600 * HZ}; ...@@ -24,7 +24,7 @@ static int min_t3[1], max_t3[] = {3600 * HZ};
static int min_idle[1], max_idle[] = {65535 * HZ}; static int min_idle[1], max_idle[] = {65535 * HZ};
static int min_n2[] = {1}, max_n2[] = {31}; static int min_n2[] = {1}, max_n2[] = {31};
static int min_paclen[] = {1}, max_paclen[] = {512}; static int min_paclen[] = {1}, max_paclen[] = {512};
static int min_proto[1], max_proto[] = {3}; static int min_proto[1], max_proto[] = { AX25_PROTO_MAX };
static int min_ds_timeout[1], max_ds_timeout[] = {65535 * HZ}; static int min_ds_timeout[1], max_ds_timeout[] = {65535 * HZ};
static struct ctl_table_header *ax25_table_header; static struct ctl_table_header *ax25_table_header;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment