diff options
| author | Ralf Baechle <ralf@linux-mips.org> | 2005-08-23 10:11:45 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2005-08-23 10:11:45 -0700 |
| commit | 01d7dd0e9f8c5f1888619d2649c7da389232b408 (patch) | |
| tree | ee4f22a33557bae4883eb2f4fb1359e97ac74186 /net/ax25/af_ax25.c | |
| parent | 53b924b31fa53ac3007df3fef6870d5074a9adf8 (diff) | |
| download | op-kernel-dev-01d7dd0e9f8c5f1888619d2649c7da389232b408.zip op-kernel-dev-01d7dd0e9f8c5f1888619d2649c7da389232b408.tar.gz | |
[AX25]: UID fixes
o Brown paperbag bug - ax25_findbyuid() was always returning a NULL pointer
as the result. Breaks ROSE completly and AX.25 if UID policy set to deny.
o While the list structure of AX.25's UID to callsign mapping table was
properly protected by a spinlock, it's elements were not refcounted
resulting in a race between removal and usage of an element.
Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ax25/af_ax25.c')
| -rw-r--r-- | net/ax25/af_ax25.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index 7d8ecad..a5c94f1 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1002,7 +1002,8 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) struct sock *sk = sock->sk; struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr; ax25_dev *ax25_dev = NULL; - ax25_address *call; + ax25_uid_assoc *user; + ax25_address call; ax25_cb *ax25; int err = 0; @@ -1021,9 +1022,15 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) if (addr->fsa_ax25.sax25_family != AF_AX25) return -EINVAL; - call = ax25_findbyuid(current->euid); - if (call == NULL && ax25_uid_policy && !capable(CAP_NET_ADMIN)) { - return -EACCES; + user = ax25_findbyuid(current->euid); + if (user) { + call = user->call; + ax25_uid_put(user); + } else { + if (ax25_uid_policy && !capable(CAP_NET_ADMIN)) + return -EACCES; + + call = addr->fsa_ax25.sax25_call; } lock_sock(sk); @@ -1034,10 +1041,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) goto out; } - if (call == NULL) - ax25->source_addr = addr->fsa_ax25.sax25_call; - else - ax25->source_addr = *call; + ax25->source_addr = call; /* * User already set interface with SO_BINDTODEVICE |
