Merge git://oss.sgi.com:8090/xfs/linux-2.6

[pandora-kernel.git] / net / sctp / socket.c

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 79bece1..5ffb9de 100644 (file)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3055,6 +3055,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
 {
        struct sctp_authchunk val;
 
+       if (!sctp_auth_enable)
+               return -EACCES;
+
        if (optlen != sizeof(struct sctp_authchunk))
                return -EINVAL;
        if (copy_from_user(&val, optval, optlen))
@@ -3083,8 +3086,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                                    int optlen)
 {
        struct sctp_hmacalgo *hmacs;
+       u32 idents;
        int err;
 
+       if (!sctp_auth_enable)
+               return -EACCES;
+
        if (optlen < sizeof(struct sctp_hmacalgo))
                return -EINVAL;
 
@@ -3097,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                goto out;
        }
 
-       if (hmacs->shmac_num_idents == 0 ||
-           hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
+       idents = hmacs->shmac_num_idents;
+       if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
+           (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
                err = -EINVAL;
                goto out;
        }
@@ -3123,6 +3131,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
        struct sctp_association *asoc;
        int ret;
 
+       if (!sctp_auth_enable)
+               return -EACCES;
+
        if (optlen <= sizeof(struct sctp_authkey))
                return -EINVAL;
 
@@ -3135,6 +3146,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
                goto out;
        }
 
+       if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
        if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
                ret = -EINVAL;
@@ -3160,6 +3176,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
        struct sctp_authkeyid val;
        struct sctp_association *asoc;
 
+       if (!sctp_auth_enable)
+               return -EACCES;
+
        if (optlen != sizeof(struct sctp_authkeyid))
                return -EINVAL;
        if (copy_from_user(&val, optval, optlen))
@@ -3185,6 +3204,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
        struct sctp_authkeyid val;
        struct sctp_association *asoc;
 
+       if (!sctp_auth_enable)
+               return -EACCES;
+
        if (optlen != sizeof(struct sctp_authkeyid))
                return -EINVAL;
        if (copy_from_user(&val, optval, optlen))
@@ -3910,7 +3932,7 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval
                goto out;
 
        /* Map the socket to an unused fd that can be returned to the user.  */
-       retval = sock_map_fd(newsock);
+       retval = sock_map_fd(newsock, 0);
        if (retval < 0) {
                sock_release(newsock);
                goto out;
@@ -5197,19 +5219,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
 static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
                                    char __user *optval, int __user *optlen)
 {
+       struct sctp_hmacalgo  __user *p = (void __user *)optval;
        struct sctp_hmac_algo_param *hmacs;
-       __u16 param_len;
+       __u16 data_len = 0;
+       u32 num_idents;
+
+       if (!sctp_auth_enable)
+               return -EACCES;
 
        hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
-       param_len = ntohs(hmacs->param_hdr.length);
+       data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
 
-       if (len < param_len)
+       if (len < sizeof(struct sctp_hmacalgo) + data_len)
                return -EINVAL;
+
+       len = sizeof(struct sctp_hmacalgo) + data_len;
+       num_idents = data_len / sizeof(u16);
+
        if (put_user(len, optlen))
                return -EFAULT;
-       if (copy_to_user(optval, hmacs->hmac_ids, len))
+       if (put_user(num_idents, &p->shmac_num_idents))
+               return -EFAULT;
+       if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
                return -EFAULT;
-
        return 0;
 }
 
@@ -5219,6 +5251,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
        struct sctp_authkeyid val;
        struct sctp_association *asoc;
 
+       if (!sctp_auth_enable)
+               return -EACCES;
+
        if (len < sizeof(struct sctp_authkeyid))
                return -EINVAL;
        if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
@@ -5233,6 +5268,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
        else
                val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
 
+       len = sizeof(struct sctp_authkeyid);
+       if (put_user(len, optlen))
+               return -EFAULT;
+       if (copy_to_user(optval, &val, len))
+               return -EFAULT;
+
        return 0;
 }
 
@@ -5243,13 +5284,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
        struct sctp_authchunks val;
        struct sctp_association *asoc;
        struct sctp_chunks_param *ch;
-       u32    num_chunks;
+       u32    num_chunks = 0;
        char __user *to;
 
-       if (len <= sizeof(struct sctp_authchunks))
+       if (!sctp_auth_enable)
+               return -EACCES;
+
+       if (len < sizeof(struct sctp_authchunks))
                return -EINVAL;
 
-       if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
+       if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
                return -EFAULT;
 
        to = p->gauth_chunks;
@@ -5258,20 +5302,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
                return -EINVAL;
 
        ch = asoc->peer.peer_chunks;
+       if (!ch)
+               goto num;
 
        /* See if the user provided enough room for all the data */
        num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
        if (len < num_chunks)
                return -EINVAL;
 
-       len = num_chunks;
-       if (put_user(len, optlen))
+       if (copy_to_user(to, ch->chunks, num_chunks))
                return -EFAULT;
+num:
+       len = sizeof(struct sctp_authchunks) + num_chunks;
+       if (put_user(len, optlen)) return -EFAULT;
        if (put_user(num_chunks, &p->gauth_number_of_chunks))
                return -EFAULT;
-       if (copy_to_user(to, ch->chunks, len))
-               return -EFAULT;
-
        return 0;
 }
 
@@ -5282,13 +5327,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
        struct sctp_authchunks val;
        struct sctp_association *asoc;
        struct sctp_chunks_param *ch;
-       u32    num_chunks;
+       u32    num_chunks = 0;
        char __user *to;
 
-       if (len <= sizeof(struct sctp_authchunks))
+       if (!sctp_auth_enable)
+               return -EACCES;
+
+       if (len < sizeof(struct sctp_authchunks))
                return -EINVAL;
 
-       if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
+       if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
                return -EFAULT;
 
        to = p->gauth_chunks;
@@ -5301,17 +5349,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
        else
                ch = sctp_sk(sk)->ep->auth_chunk_list;
 
+       if (!ch)
+               goto num;
+
        num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
-       if (len < num_chunks)
+       if (len < sizeof(struct sctp_authchunks) + num_chunks)
                return -EINVAL;
 
-       len = num_chunks;
+       if (copy_to_user(to, ch->chunks, num_chunks))
+               return -EFAULT;
+num:
+       len = sizeof(struct sctp_authchunks) + num_chunks;
        if (put_user(len, optlen))
                return -EFAULT;
        if (put_user(num_chunks, &p->gauth_number_of_chunks))
                return -EFAULT;
-       if (copy_to_user(to, ch->chunks, len))
-               return -EFAULT;
 
        return 0;
 }