diff options
| author | Wang Chen <wangchen@cn.fujitsu.com> | 2008-07-14 20:49:46 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-07-14 20:49:46 -0700 |
| commit | 2aeb0b88b3c7a0e3bef55e7ff0efffd5d971aa57 (patch) | |
| tree | 5b944f469ab809b4e88f6b25b99e8488f58983ce /net | |
| parent | fc943b12e48f9341bce48c2fadf094cc721aab93 (diff) | |
af_packet: Check return of dev_set_promiscuity/allmulti
dev_set_promiscuity/allmulti might overflow. Commit: "netdevice: Fix
promiscuity and allmulti overflow" in net-next makes
dev_set_promiscuity/allmulti return error number if overflow happened.
In af_packet, we check all positive increment for promiscuity and
allmulti to get error return.
Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/packet/af_packet.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index beca6402f1c..9f226916668 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1173,7 +1173,8 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, return 0; } -static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what) +static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i, + int what) { switch (i->type) { case PACKET_MR_MULTICAST: @@ -1183,13 +1184,14 @@ static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int w dev_mc_delete(dev, i->addr, i->alen, 0); break; case PACKET_MR_PROMISC: - dev_set_promiscuity(dev, what); + return dev_set_promiscuity(dev, what); break; case PACKET_MR_ALLMULTI: - dev_set_allmulti(dev, what); + return dev_set_allmulti(dev, what); break; default:; } + return 0; } static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what) @@ -1243,7 +1245,11 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) i->count = 1; i->next = po->mclist; po->mclist = i; - packet_dev_mc(dev, i, +1); + err = packet_dev_mc(dev, i, 1); + if (err) { + po->mclist = i->next; + kfree(i); + } done: rtnl_unlock(); |