Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753575Ab2KFWVm (ORCPT ); Tue, 6 Nov 2012 17:21:42 -0500 Received: from [93.179.225.50] ([93.179.225.50]:39247 "EHLO shrek.podlesie.net" rhost-flags-FAIL-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1753287Ab2KFWU0 (ORCPT ); Tue, 6 Nov 2012 17:20:26 -0500 From: Krzysztof Mazur To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Chas Williams - CONTRACTOR , David Woodhouse , davem@davemloft.net, Krzysztof Mazur Subject: [PATCH v3 3/7] pppoatm: allow assign only on a connected socket Date: Tue, 6 Nov 2012 23:16:58 +0100 Message-Id: <1352240222-363-4-git-send-email-krzysiek@podlesie.net> X-Mailer: git-send-email 1.8.0.233.g54991f2 In-Reply-To: <1352240222-363-1-git-send-email-krzysiek@podlesie.net> References: <1352240222-363-1-git-send-email-krzysiek@podlesie.net> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2595 Lines: 70 The pppoatm does not check if used vcc is in connected state, causing an Oops in pppoatm_send() when vcc->send() is called on not fully connected socket. Now pppoatm can be assigned only on connected sockets; otherwise -EINVAL error is returned. Signed-off-by: Krzysztof Mazur Cc: David Woodhouse Cc: Chas Williams - CONTRACTOR --- Oops triggered by pppd with pppoatm plugin with removed connect(): BUG: unable to handle kernel NULL pointer dereference at (null) IP: [< (null)>] (null) *pde = 00000000 Oops: 0000 [#1] PREEMPT Pid: 4154, comm: pppd Not tainted 3.6.0-krzysiek-00002-g3ff1093 #95 /AK32 EIP: 0060:[<00000000>] EFLAGS: 00010202 CPU: 0 EIP is at 0x0 EAX: d95f7800 EBX: d9d4ba80 ECX: d95f7800 EDX: d9d4ba80 ESI: ffffffff EDI: 00000001 EBP: 000001c0 ESP: d9823f34 DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 CR0: 8005003b CR2: 00000000 CR3: 1e7b6000 CR4: 000007d0 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff0ff0 DR7: 00000400 Process pppd (pid: 4154, ti=d9822000 task=d99918a0 task.ti=d9822000) Stack: c060cd9b c043a2ca d99ed860 d99ed864 d9d4ba80 08094f22 c043a228 d9d4ba80 d99ed860 0000000c c043a347 ffffffff 0000000c d94311a0 08094f22 c043a290 c019f72e d9823f9c 00000003 09df1090 d94311a0 08094f22 00000008 d9822000 Call Trace: [] ? pppoatm_send+0x6b/0x300 [] ? ppp_write+0x3a/0xe0 [] ? ppp_channel_push+0x38/0xa0 [] ? ppp_write+0xb7/0xe0 [] ? ppp_channel_push+0xa0/0xa0 [] ? vfs_write+0x8e/0x140 [] ? sys_write+0x3c/0x70 [] ? sysenter_do_call+0x12/0x26 Code: Bad EIP value. EIP: [<00000000>] 0x0 SS:ESP 0068:d9823f34 CR2: 0000000000000000 ---[ end trace e29cf1805f576278 ]--- Kernel panic - not syncing: Fatal exception in interrupt net/atm/pppoatm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c index 226dca9..f27a07a 100644 --- a/net/atm/pppoatm.c +++ b/net/atm/pppoatm.c @@ -406,6 +406,8 @@ static int pppoatm_ioctl(struct socket *sock, unsigned int cmd, return -ENOIOCTLCMD; if (!capable(CAP_NET_ADMIN)) return -EPERM; + if (sock->state != SS_CONNECTED) + return -EINVAL; return pppoatm_assign_vcc(atmvcc, argp); } case PPPIOCGCHAN: -- 1.8.0.233.g54991f2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/