From patchwork Fri Sep 25 13:10:38 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarek Poplawski X-Patchwork-Id: 34271 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id D8B60B7B83 for ; Fri, 25 Sep 2009 23:11:00 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752760AbZIYNKn (ORCPT ); Fri, 25 Sep 2009 09:10:43 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752669AbZIYNKn (ORCPT ); Fri, 25 Sep 2009 09:10:43 -0400 Received: from fg-out-1718.google.com ([72.14.220.153]:22856 "EHLO fg-out-1718.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752612AbZIYNKm (ORCPT ); Fri, 25 Sep 2009 09:10:42 -0400 Received: by fg-out-1718.google.com with SMTP id 22so875410fge.1 for ; Fri, 25 Sep 2009 06:10:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=aW9KjO4R1q9MPpFC4Yl8zYrxKOdi4jz6379sOP9pqgs=; b=LMzgM9fLfgNDyyreEvLTvdLK9AsX2OsV3/Gxo4/0qFIrA+qzxrDGxSspOhV+xv6FFu LXwoJkoD8e4v7cxnxKo21YGIi+dVxFHNMi2blFPC0AmlrZoD5q+qn37SY5AlVpSOGPE6 tfHuwK9IdSnUApMmQq6AtSLzqeIg8U8F3OHHI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; b=JB7uHmnAtkE7plbQomsv41QZTHs4TyUCIbK/GrbtXd0fcwzORNjqjyvnSIDWryImVD p8H68KnRiYBGKeD+DQ3zO6moDHXbSrn7FZGtlT8792QeNl/j+W1I+CwPacRFMhS7qPGB DXklk1DWM/mEY2v7udCanS7bcqSkRJ02LiOpE= Received: by 10.86.226.32 with SMTP id y32mr896239fgg.77.1253884244727; Fri, 25 Sep 2009 06:10:44 -0700 (PDT) Received: from ff.dom.local (bv170.internetdsl.tpnet.pl [80.53.205.170]) by mx.google.com with ESMTPS id e11sm363820fga.16.2009.09.25.06.10.41 (version=SSLv3 cipher=RC4-MD5); Fri, 25 Sep 2009 06:10:43 -0700 (PDT) Date: Fri, 25 Sep 2009 13:10:38 +0000 From: Jarek Poplawski To: David Miller Cc: Bernard Pidoux F6BVP , Bernard Pidoux , Ralf Baechle DL5RB , Linux Netdev List , linux-hams Subject: [PATCH] ax25: Fix ax25_cb refcounting in ax25_ctl_ioctl Message-ID: <20090925131038.GA14778@ff.dom.local> References: <20090921201157.GA5460@del.dom.local> <4ABA9058.3010605@free.fr> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <4ABA9058.3010605@free.fr> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This bug isn't responsible for these oopses here, but looks quite obviously. (I'm not sure if it's easy to test/hit with the common tools.) Jarek P. ------------> [PATCH] ax25: Fix ax25_cb refcounting in ax25_ctl_ioctl Use ax25_cb_put after ax25_find_cb in ax25_ctl_ioctl. Reported-by: Bernard Pidoux F6BVP Signed-off-by: Jarek Poplawski Reviewed-by: Ralf Baechle --- net/ax25/af_ax25.c | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index d6b1b05..fbcac76 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -358,6 +358,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) ax25_dev *ax25_dev; ax25_cb *ax25; unsigned int k; + int ret = 0; if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl))) return -EFAULT; @@ -388,57 +389,63 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) case AX25_WINDOW: if (ax25->modulus == AX25_MODULUS) { if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7) - return -EINVAL; + goto einval_put; } else { if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63) - return -EINVAL; + goto einval_put; } ax25->window = ax25_ctl.arg; break; case AX25_T1: if (ax25_ctl.arg < 1) - return -EINVAL; + goto einval_put; ax25->rtt = (ax25_ctl.arg * HZ) / 2; ax25->t1 = ax25_ctl.arg * HZ; break; case AX25_T2: if (ax25_ctl.arg < 1) - return -EINVAL; + goto einval_put; ax25->t2 = ax25_ctl.arg * HZ; break; case AX25_N2: if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31) - return -EINVAL; + goto einval_put; ax25->n2count = 0; ax25->n2 = ax25_ctl.arg; break; case AX25_T3: if (ax25_ctl.arg < 0) - return -EINVAL; + goto einval_put; ax25->t3 = ax25_ctl.arg * HZ; break; case AX25_IDLE: if (ax25_ctl.arg < 0) - return -EINVAL; + goto einval_put; ax25->idle = ax25_ctl.arg * 60 * HZ; break; case AX25_PACLEN: if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535) - return -EINVAL; + goto einval_put; ax25->paclen = ax25_ctl.arg; break; default: - return -EINVAL; + goto einval_put; } - return 0; +out_put: + ax25_cb_put(ax25); + return ret; + +einval_put: + ret = -EINVAL; + goto out_put; } static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)