summaryrefslogtreecommitdiffstats
path: root/net/dccp/proto.c
diff options
context:
space:
mode:
authorTomasz Grobelny <tomasz@grobelny.oswiecenia.net>2008-09-04 07:30:19 +0200
committerGerrit Renker <gerrit@erg.abdn.ac.uk>2008-09-04 07:45:40 +0200
commit7d1af6a8d935678248d057564e75e1452409a53c (patch)
tree06ea5f0d3e819e99609df3ef741574cdfac4aab9 /net/dccp/proto.c
parentd6da3511d6b558d0b017777b61dc08b8fbc06ea4 (diff)
downloadlinux-7d1af6a8d935678248d057564e75e1452409a53c.tar.bz2
dccp qpolicy: Parameter checking of cmsg qpolicy parameters
Ensure that cmsg->cmsg_type value is valid for qpolicy that is currently in use. Signed-off-by: Tomasz Grobelny <tomasz@grobelny.oswiecenia.net> Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Diffstat (limited to 'net/dccp/proto.c')
-rw-r--r--net/dccp/proto.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b56efdd2a421..a3caa11aa836 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -735,6 +735,10 @@ static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
if (cmsg->cmsg_level != SOL_DCCP)
continue;
+ if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
+ !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
+ return -EINVAL;
+
switch (cmsg->cmsg_type) {
case DCCP_SCM_PRIORITY:
if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))