af_packet: move strict addr_len check right before dev_[mc/unicast]_[add/del]

My previous patch 914c8ad2d18b62ad1420f518c0cab0b0b90ab308 incorrectly changed
the length check in packet_mc_add to be more strict. The problem is that
userspace is not filling this field (and it stays zeroed) in case of setting
PACKET_MR_PROMISC or PACKET_MR_ALLMULTI. So move the strict check to the point
in path where the addr_len must be set correctly.

Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Reported-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 031a5e6fb4aa9c8dfc64f7a780cdb15496eb759f..1612d417d10c5b631c4aeea78207cd8e34a0a305 100644 (file)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1688,6 +1688,8 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
 {
        switch (i->type) {
        case PACKET_MR_MULTICAST:
+               if (i->alen != dev->addr_len)
+                       return -EINVAL;
                if (what > 0)
                        return dev_mc_add(dev, i->addr, i->alen, 0);
                else
@@ -1700,6 +1702,8 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
                return dev_set_allmulti(dev, what);
                break;
        case PACKET_MR_UNICAST:
+               if (i->alen != dev->addr_len)
+                       return -EINVAL;
                if (what > 0)
                        return dev_unicast_add(dev, i->addr);
                else
@@ -1734,7 +1738,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
                goto done;
 
        err = -EINVAL;
-       if (mreq->mr_alen != dev->addr_len)
+       if (mreq->mr_alen > dev->addr_len)
                goto done;
 
        err = -ENOBUFS;