af_packet: Check return of dev_set_promiscuity/allmulti

dev_set_promiscuity/allmulti might overflow.  Commit: "netdevice: Fix
promiscuity and allmulti overflow" in net-next makes
dev_set_promiscuity/allmulti return error number if overflow happened.

In af_packet, we check all positive increment for promiscuity and
allmulti to get error return.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index beca6402f1cf104bb603f0607c3136222ef40a45..9f2269166687202861f9984cfe7b753094d02703 100644 (file)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1173,7 +1173,8 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
        return 0;
 }
 
-static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
+static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
+                        int what)
 {
        switch (i->type) {
        case PACKET_MR_MULTICAST:
@@ -1183,13 +1184,14 @@ static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int w
                        dev_mc_delete(dev, i->addr, i->alen, 0);
                break;
        case PACKET_MR_PROMISC:
-               dev_set_promiscuity(dev, what);
+               return dev_set_promiscuity(dev, what);
                break;
        case PACKET_MR_ALLMULTI:
-               dev_set_allmulti(dev, what);
+               return dev_set_allmulti(dev, what);
                break;
        default:;
        }
+       return 0;
 }
 
 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
@@ -1243,7 +1245,11 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
        i->count = 1;
        i->next = po->mclist;
        po->mclist = i;
-       packet_dev_mc(dev, i, +1);
+       err = packet_dev_mc(dev, i, 1);
+       if (err) {
+               po->mclist = i->next;
+               kfree(i);
+       }
 
 done:
        rtnl_unlock();