af_rose/x25: Sanity check the maximum user frame size

[mirror_ubuntu-artful-kernel.git] / net / netrom / af_netrom.c

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index e9c05b8f4f4517fc5b13b6295eebfd1cf75e0a1c..d1c16bbee9326b7f3cbce9421e276310dffa4d2e 100644 (file)
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1037,6 +1037,10 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
        unsigned char *asmptr;
        int size;
 
+       /* Netrom empty data frame has no meaning : don't send */
+       if (len == 0)
+               return 0;
+
        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
                return -EINVAL;
 
@@ -1082,7 +1086,11 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
 
-       /* Build a packet */
+       /* Build a packet - the conventional user limit is 236 bytes. We can
+          do ludicrously large NetROM frames but must not overflow */
+       if (len > 65536)
+               return -EMSGSIZE;
+
        SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
        size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
 
@@ -1167,6 +1175,11 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb_reset_transport_header(skb);
        copied     = skb->len;
 
+       /* NetRom empty data frame has no meaning : ignore it */
+       if (copied == 0) {
+               goto out;
+       }
+
        if (copied > size) {
                copied = size;
                msg->msg_flags |= MSG_TRUNC;
@@ -1182,7 +1195,7 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
 
        msg->msg_namelen = sizeof(*sax);
 
-       skb_free_datagram(sk, skb);
+out:   skb_free_datagram(sk, skb);
 
        release_sock(sk);
        return copied;
@@ -1432,7 +1445,7 @@ static int __init nr_proto_init(void)
                struct net_device *dev;
 
                sprintf(name, "nr%d", i);
-               dev = alloc_netdev(sizeof(struct nr_private), name, nr_setup);
+               dev = alloc_netdev(0, name, nr_setup);
                if (!dev) {
                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device structure\n");
                        goto fail;