summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorRalf Baechle DL5RB <ralf@linux-mips.org>2006-03-19 13:20:06 -0800
committerDavid S. Miller <davem@davemloft.net>2006-03-19 13:20:06 -0800
commitc7c694d196a39af6e644e24279953d04f30362db (patch)
treecb78fead47ce86245179fe0a52119c70b30b59cb /net
parent60a6dc55b93b3321afa52f650a149fb7e87fa85a (diff)
downloadlinux-3.10-c7c694d196a39af6e644e24279953d04f30362db.tar.gz
linux-3.10-c7c694d196a39af6e644e24279953d04f30362db.tar.bz2
linux-3.10-c7c694d196a39af6e644e24279953d04f30362db.zip
[AX.25]: Fix potencial memory hole.
If the AX.25 dialect chosen by the sysadmin is set to DAMA master / 3 (or DAMA slave / 2, if CONFIG_AX25_DAMA_SLAVE=n) ax25_kick() will fall through the switch statement without calling ax25_send_iframe() or any other function that would eventually free skbn thus leaking the packet. Fix by restricting the sysctl inferface to allow only actually supported AX.25 dialects. The system administration mistake needed for this to happen is rather unlikely, so this is an uncritical hole. Coverity #651. Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ax25/sysctl_net_ax25.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f67711f2ee9..894a22558d9 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -24,7 +24,7 @@ static int min_t3[1], max_t3[] = {3600 * HZ};
static int min_idle[1], max_idle[] = {65535 * HZ};
static int min_n2[] = {1}, max_n2[] = {31};
static int min_paclen[] = {1}, max_paclen[] = {512};
-static int min_proto[1], max_proto[] = {3};
+static int min_proto[1], max_proto[] = { AX25_PROTO_MAX };
static int min_ds_timeout[1], max_ds_timeout[] = {65535 * HZ};
static struct ctl_table_header *ax25_table_header;