lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[AX25]: UID fixes

Browse Source 
o Brown paperbag bug - ax25_findbyuid() was always returning a NULL pointer
   as the result.  Breaks ROSE completly and AX.25 if UID policy set to deny.

 o While the list structure of AX.25's UID to callsign mapping table was
   properly protected by a spinlock, it's elements were not refcounted
   resulting in a race between removal and usage of an element.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ralf Baechle
2005-08-23 10:11:45 -07:00
committed by David S. Miller
parent 53b924b31f
commit 01d7dd0e9f
6 changed files with 100 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
net/ax25/af_ax25.c
View File

@ -1002,7 +1002,8 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
struct sock *sk = sock->sk;
struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
ax25_dev *ax25_dev = NULL;
ax25_address *call;
ax25_uid_assoc *user;
ax25_address call;
ax25_cb *ax25;
int err = 0;
@ -1021,9 +1022,15 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
if (addr->fsa_ax25.sax25_family != AF_AX25)
return -EINVAL;
call = ax25_findbyuid(current->euid);
if (call == NULL && ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
return -EACCES;
user = ax25_findbyuid(current->euid);
if (user) {
call = user->call;
ax25_uid_put(user);
} else {
if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
return -EACCES;
call = addr->fsa_ax25.sax25_call;
}
lock_sock(sk);
@ -1034,10 +1041,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
goto out;
}
if (call == NULL)
ax25->source_addr = addr->fsa_ax25.sax25_call;
else
ax25->source_addr = *call;
ax25->source_addr = call;
/*
* User already set interface with SO_BINDTODEVICE