[AX.25]: Fix potencial memory hole.

If the AX.25 dialect chosen by the sysadmin is set to DAMA master / 3
(or DAMA slave / 2, if CONFIG_AX25_DAMA_SLAVE=n) ax25_kick() will fall
through the switch statement without calling ax25_send_iframe() or any
other function that would eventually free skbn thus leaking the packet.

Fix by restricting the sysctl inferface to allow only actually supported
AX.25 dialects.

The system administration mistake needed for this to happen is rather
unlikely, so this is an uncritical hole.

Coverity #651.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/ax25.h b/include/net/ax25.h
index 2250a18b0cbb5fe2cb88a51dd5c2f0ca3af70cd2..d052b221dbcd4b5ce124e9ee3a0c64358a2dbf1d 100644 (file)
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -110,8 +110,15 @@ enum {
 enum {
        AX25_PROTO_STD_SIMPLEX,
        AX25_PROTO_STD_DUPLEX,
+#ifdef CONFIG_AX25_DAMA_SLAVE
        AX25_PROTO_DAMA_SLAVE,
-       AX25_PROTO_DAMA_MASTER
+#ifdef CONFIG_AX25_DAMA_MASTER
+       AX25_PROTO_DAMA_MASTER,
+#define AX25_PROTO_MAX AX25_PROTO_DAMA_MASTER
+#endif
+#endif
+       __AX25_PROTO_MAX,
+       AX25_PROTO_MAX = __AX25_PROTO_MAX -1
 };
 
 enum {

diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f67711f2ee96c51dee92fda1779cc039dd987bc4..894a22558d9dc7fb2604c0d84c64cf62873e4803 100644 (file)
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -24,7 +24,7 @@ static int min_t3[1],                 max_t3[] = {3600 * HZ};
 static int min_idle[1],                max_idle[] = {65535 * HZ};
 static int min_n2[] = {1},             max_n2[] = {31};
 static int min_paclen[] = {1},         max_paclen[] = {512};
-static int min_proto[1],               max_proto[] = {3};
+static int min_proto[1],               max_proto[] = { AX25_PROTO_MAX };
 static int min_ds_timeout[1],          max_ds_timeout[] = {65535 * HZ};
 
 static struct ctl_table_header *ax25_table_header;