1 files changed, 41 insertions, 18 deletions

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index d301ac51bbe1..1e20b719fb3c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -98,8 +98,16 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
 {
         u8 rc = LLC_PDU_LEN_U;
 
-        if (addr->sllc_test || addr->sllc_xid)
+        if (addr->sllc_test)
                 rc = LLC_PDU_LEN_U;
+        else if (addr->sllc_xid)
+                /* We need to expand header to sizeof(struct llc_xid_info)
+                 * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header
+                 * as XID PDU. In llc_ui_sendmsg() we reserved header size and then
+                 * filled all other space with user data. If we won't reserve this
+                 * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data
+                 */
+                rc = LLC_PDU_LEN_U_XID;
         else if (sk->sk_type == SOCK_STREAM)
                 rc = LLC_PDU_LEN_I;
         return rc;
@@ -268,6 +276,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
 {
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
+        struct net_device *dev = NULL;
         struct llc_sap *sap;
         int rc = -EINVAL;
 
@@ -279,14 +288,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
                 goto out;
         rc = -ENODEV;
         if (sk->sk_bound_dev_if) {
-                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
-                if (llc->dev && addr->sllc_arphrd != llc->dev->type) {
-                        dev_put(llc->dev);
-                        llc->dev = NULL;
+                dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (dev && addr->sllc_arphrd != dev->type) {
+                        dev_put(dev);
+                        dev = NULL;
                 }
         } else
-                llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
-        if (!llc->dev)
+                dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
+        if (!dev)
                 goto out;
         rc = -EUSERS;
         llc->laddr.lsap = llc_ui_autoport();
@@ -296,6 +305,11 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
         sap = llc_sap_open(llc->laddr.lsap, NULL);
         if (!sap)
                 goto out;
+
+        /* Note: We do not expect errors from this point. */
+        llc->dev = dev;
+        dev = NULL;
+
         memcpy(llc->laddr.mac, llc->dev->dev_addr, IFHWADDRLEN);
         memcpy(&llc->addr, addr, sizeof(llc->addr));
         /* assign new connection to its SAP */
@@ -303,6 +317,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
         sock_reset_flag(sk, SOCK_ZAPPED);
         rc = 0;
 out:
+        dev_put(dev);
         return rc;
 }
 
@@ -325,6 +340,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr;
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
+        struct net_device *dev = NULL;
         struct llc_sap *sap;
         int rc = -EINVAL;
 
@@ -341,25 +357,26 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         rc = -ENODEV;
         rcu_read_lock();
         if (sk->sk_bound_dev_if) {
-                llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
-                if (llc->dev) {
+                dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
+                if (dev) {
                         if (is_zero_ether_addr(addr->sllc_mac))
-                                memcpy(addr->sllc_mac, llc->dev->dev_addr,
+                                memcpy(addr->sllc_mac, dev->dev_addr,
                                        IFHWADDRLEN);
-                        if (addr->sllc_arphrd != llc->dev->type ||
+                        if (addr->sllc_arphrd != dev->type ||
                             !ether_addr_equal(addr->sllc_mac,
-                                              llc->dev->dev_addr)) {
+                                              dev->dev_addr)) {
                                 rc = -EINVAL;
-                                llc->dev = NULL;
+                                dev = NULL;
                         }
                 }
-        } else
-                llc->dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd,
+        } else {
+                dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd,
                                            addr->sllc_mac);
-        if (llc->dev)
-                dev_hold(llc->dev);
+        }
+        if (dev)
+                dev_hold(dev);
         rcu_read_unlock();
-        if (!llc->dev)
+        if (!dev)
                 goto out;
         if (!addr->sllc_sap) {
                 rc = -EUSERS;
@@ -392,6 +409,11 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                         goto out_put;
                 }
         }
+
+        /* Note: We do not expect errors from this point. */
+        llc->dev = dev;
+        dev = NULL;
+
         llc->laddr.lsap = addr->sllc_sap;
         memcpy(llc->laddr.mac, addr->sllc_mac, IFHWADDRLEN);
         memcpy(&llc->addr, addr, sizeof(llc->addr));
@@ -402,6 +424,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 out_put:
         llc_sap_put(sap);
 out:
+        dev_put(dev);
         release_sock(sk);
         return rc;
 }