diff options
| author | Johannes Stezenbach <js@linuxtv.org> | 2004-12-12 17:02:47 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2004-12-12 17:02:47 -0800 |
| commit | aad1aaf4e494e87acb8bc3975db16783ef484b1c (patch) | |
| tree | 55332818fd9bf8636efc3427dfcc6a02fbfcb145 | |
| parent | f0d63d81c47befed36ac79112053142825db349f (diff) | |
[PATCH] fix dvb-net Oops
emard<at>softhome!net discovered an embarrasing bug in dvb_net.c where
the NET_REMOVE_IF ioctl will cause an Oops when called with an invalid
interface number.
Signed-off-by: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | drivers/media/dvb/dvb-core/dvb_net.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c index c7e794a35305..805cf3c5dbcb 100644 --- a/drivers/media/dvb/dvb-core/dvb_net.c +++ b/drivers/media/dvb/dvb-core/dvb_net.c @@ -1201,13 +1201,14 @@ static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype) } -static int dvb_net_remove_if(struct dvb_net *dvbnet, int num) +static int dvb_net_remove_if(struct dvb_net *dvbnet, unsigned int num) { struct net_device *net = dvbnet->device[num]; - struct dvb_net_priv *priv = net->priv; + struct dvb_net_priv *priv; if (!dvbnet->state[num]) return -EINVAL; + priv = net->priv; if (priv->in_use) return -EBUSY; @@ -1268,10 +1269,18 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file, break; } case NET_REMOVE_IF: + { + int ret; + if (!capable(CAP_SYS_ADMIN)) return -EPERM; - module_put(dvbdev->adapter->module); - return dvb_net_remove_if(dvbnet, (int) (long) parg); + if ((unsigned int) parg >= DVB_NET_DEVICES_MAX) + return -EINVAL; + ret = dvb_net_remove_if(dvbnet, (unsigned int) parg); + if (!ret) + module_put(dvbdev->adapter->module); + return ret; + } /* binary compatiblity cruft */ case __NET_ADD_IF_OLD: |