rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493

[linux-flexiantxendom0-natty.git] / net / rose / af_rose.c

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index e5f478c..9eb767f 100644 (file)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -18,6 +18,7 @@
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
@@ -63,7 +64,7 @@ int sysctl_rose_window_size             = ROSE_DEFAULT_WINDOW_SIZE;
 static HLIST_HEAD(rose_list);
 static DEFINE_SPINLOCK(rose_list_lock);
 
-static struct proto_ops rose_proto_ops;
+static const struct proto_ops rose_proto_ops;
 
 ax25_address rose_callsign;
 
@@ -370,7 +371,7 @@ void rose_destroy_socket(struct sock *sk)
  */
 
 static int rose_setsockopt(struct socket *sock, int level, int optname,
-       char __user *optval, int optlen)
+       char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct rose_sock *rose = rose_sk(sk);
@@ -512,12 +513,13 @@ static struct proto rose_proto = {
        .obj_size = sizeof(struct rose_sock),
 };
 
-static int rose_create(struct net *net, struct socket *sock, int protocol)
+static int rose_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
        struct sock *sk;
        struct rose_sock *rose;
 
-       if (net != &init_net)
+       if (!net_eq(net, &init_net))
                return -EAFNOSUPPORT;
 
        if (sock->type != SOCK_SEQPACKET || protocol != 0)
@@ -677,7 +679,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                return -EINVAL;
 
-       if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+       if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                return -EINVAL;
 
        if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) {
@@ -737,7 +739,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                return -EINVAL;
 
-       if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+       if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                return -EINVAL;
 
        /* Source + Destination digis should not exceed ROSE_MAX_DIGIS */
@@ -843,7 +845,7 @@ rose_try_next_neigh:
                DEFINE_WAIT(wait);
 
                for (;;) {
-                       prepare_to_wait(sk->sk_sleep, &wait,
+                       prepare_to_wait(sk_sleep(sk), &wait,
                                        TASK_INTERRUPTIBLE);
                        if (sk->sk_state != TCP_SYN_SENT)
                                break;
@@ -856,7 +858,7 @@ rose_try_next_neigh:
                        err = -ERESTARTSYS;
                        break;
                }
-               finish_wait(sk->sk_sleep, &wait);
+               finish_wait(sk_sleep(sk), &wait);
 
                if (err)
                        goto out_release;
@@ -909,7 +911,7 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
         *      hooked into the SABM we saved
         */
        for (;;) {
-               prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+               prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
                skb = skb_dequeue(&sk->sk_receive_queue);
                if (skb)
@@ -928,7 +930,7 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
                err = -ERESTARTSYS;
                break;
        }
-       finish_wait(sk->sk_sleep, &wait);
+       finish_wait(sk_sleep(sk), &wait);
        if (err)
                goto out_release;
 
@@ -983,7 +985,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
        struct sock *make;
        struct rose_sock *make_rose;
        struct rose_facilities_struct facilities;
-       int n, len;
+       int n;
 
        skb->sk = NULL;         /* Initially we don't know who it's for */
 
@@ -992,9 +994,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
         */
        memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
 
-       len  = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-       len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
-       if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
+       if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
+                                  skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
+                                  &facilities)) {
                rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
                return 0;
        }
@@ -1403,29 +1405,13 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *rose_info_start(struct seq_file *seq, loff_t *pos)
        __acquires(rose_list_lock)
 {
-       int i;
-       struct sock *s;
-       struct hlist_node *node;
-
        spin_lock_bh(&rose_list_lock);
-       if (*pos == 0)
-               return SEQ_START_TOKEN;
-
-       i = 1;
-       sk_for_each(s, node, &rose_list) {
-               if (i == *pos)
-                       return s;
-               ++i;
-       }
-       return NULL;
+       return seq_hlist_start_head(&rose_list, *pos);
 }
 
 static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-       ++*pos;
-
-       return (v == SEQ_START_TOKEN) ? sk_head(&rose_list)
-               : sk_next((struct sock *)v);
+       return seq_hlist_next(v, &rose_list, pos);
 }
 
 static void rose_info_stop(struct seq_file *seq, void *v)
@@ -1443,7 +1429,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
                         "dest_addr  dest_call src_addr   src_call  dev   lci neigh st vs vr va   t  t1  t2  t3  hb    idle Snd-Q Rcv-Q inode\n");
 
        else {
-               struct sock *s = v;
+               struct sock *s = sk_entry(v);
                struct rose_sock *rose = rose_sk(s);
                const char *devname, *callsign;
                const struct net_device *dev = rose->device;
@@ -1509,13 +1495,13 @@ static const struct file_operations rose_info_fops = {
 };
 #endif /* CONFIG_PROC_FS */
 
-static struct net_proto_family rose_family_ops = {
+static const struct net_proto_family rose_family_ops = {
        .family         =       PF_ROSE,
        .create         =       rose_create,
        .owner          =       THIS_MODULE,
 };
 
-static struct proto_ops rose_proto_ops = {
+static const struct proto_ops rose_proto_ops = {
        .family         =       PF_ROSE,
        .owner          =       THIS_MODULE,
        .release        =       rose_release,