From f67ed26f2b3e92c0450deae3ffc3fff21c878a75 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Thu, 23 Mar 2006 22:47:40 -0800 Subject: [NET]: Ensure device name passed to SO_BINDTODEVICE is NULL terminated. Found by Solar Designer. Signed-off-by: David S. Miller --- net/core/sock.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'net/core') diff --git a/net/core/sock.c b/net/core/sock.c index 1a7e6eac90b0..e110b9004147 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -404,8 +404,9 @@ set_rcvbuf: if (!valbool) { sk->sk_bound_dev_if = 0; } else { - if (optlen > IFNAMSIZ) - optlen = IFNAMSIZ; + if (optlen > IFNAMSIZ - 1) + optlen = IFNAMSIZ - 1; + memset(devname, 0, sizeof(devname)); if (copy_from_user(devname, optval, optlen)) { ret = -EFAULT; break; -- cgit v1.2.3-59-g8ed1b From 9f514950bb907e98f280492a091aa1889b97304e Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Sat, 25 Mar 2006 01:24:25 -0800 Subject: [NET]: Take RTNL when unregistering notifier The netdev notifier call chain is currently unregistered without taking any locks outside the notifier system. Because the notifier system itself does not synchronise unregistration with respect to the calling of the chain, we as its user need to do our own locking. We are supposed to take the RTNL for all calls to netdev notifiers, so taking the RTNL should be sufficient to protect it. The registration path in dev.c already takes the RTNL so it's OK. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/core/dev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'net/core') diff --git a/net/core/dev.c b/net/core/dev.c index 08dec6eb922b..e0489ca731c5 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -977,7 +977,12 @@ int register_netdevice_notifier(struct notifier_block *nb) int unregister_netdevice_notifier(struct notifier_block *nb) { - return notifier_chain_unregister(&netdev_chain, nb); + int err; + + rtnl_lock(); + err = notifier_chain_unregister(&netdev_chain, nb); + rtnl_unlock(); + return err; } /** -- cgit v1.2.3-59-g8ed1b