[PATCH] SO_BINDTODEVICE parameter checking in 2.2.19

[PATCH] SO_BINDTODEVICE parameter checking in 2.2.19

[Mark Aikens]

Hello,

There's a slight problem with the parameter checking in kernel version 2.2.19.
As it is now, if the parameter is less than 4 bytes long, it returns EINVAL.
That means that passing in ("lo", 3) to bind a socket to the loopback device
will never succeed.

There is also another bug where passing NULL as the parameter would unbind
the socket but still return EINVAL. That doesn't seem to be sensible behavior.

I don't know if these two bugs are in 2.4 but I've attached a patch which
fixes these bugs in 2.2.19. If you have any comments, please CC me because
I'm not on the list.

-Mark Aikens


diff -u --new-file --recursive linux-2.2.19.orig/net/core/sock.c linux-2.2.19/net/core/sock.c
--- linux-2.2.19.orig/net/core/sock.c	Sun Mar 25 11:37:41 2001
+++ linux-2.2.19/net/core/sock.c	Wed Jul 11 22:43:29 2001
@@ -174,16 +174,21 @@
 			return 0;
 	}
 #endif	
-		
-  	if(optlen<sizeof(int))
-  		return(-EINVAL);
-  	
-	err = get_user(val, (int *)optval);
-	if (err)
-		return err;
-	
-  	valbool = val?1:0;
-  	
+
+#ifdef CONFIG_NETDEVICES
+	if(optname != SO_BINDTODEVICE)
+#endif
+	{
+ 		if(optlen<sizeof(int))
+ 			return(-EINVAL);
+ 
+		err = get_user(val, (int *)optval);
+		if (err)
+			return err;
+
+		valbool = val?1:0;
+	}
+
   	switch(optname) 
   	{
 		case SO_DEBUG:	
@@ -305,7 +310,7 @@
 			 * is not bound. 
 			 */ 
 
-			if (!valbool) {
+			if (optval == NULL) {
 				sk->bound_dev_if = 0;
 			} else {
 				if (optlen > IFNAMSIZ) 
@@ -326,8 +331,8 @@
 						return -EINVAL;
 					sk->bound_dev_if = dev->ifindex;
 				}
-				return 0;
 			}
+			return 0;
 		}
 #endif