[PATCH net] atm: pppoatm: reject duplicate backend assignment

[XingWang Xiang]

pppoatm_assign_vcc() installs a backend without checking whether the VCC
already has one.

Calling ATM_SETBACKEND twice makes the second pppoatm_vcc save
pppoatm_push() as its lower push callback and overwrites the first
pppoatm_vcc in user_back. When the VCC is closed, the outer
pppoatm_push() clears user_back and invokes the saved pppoatm_push(),
which then dereferences the NULL user_back pointer.

Reject the assignment when user_back is already populated.
do_vcc_ioctl() holds ioctl_mutex while invoking backend handlers, so
concurrent backend assignments cannot race past this check.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: XingWang Xiang <v3rdant.xiang@xxxxxxxxx>
---
 net/atm/pppoatm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 6da52d12d..93ba22f43 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -396,6 +396,8 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
 	if (be.encaps != PPPOATM_ENCAPS_AUTODETECT &&
 	    be.encaps != PPPOATM_ENCAPS_VC && be.encaps != PPPOATM_ENCAPS_LLC)
 		return -EINVAL;
+	if (atmvcc->user_back)
+		return -EBUSY;
 	pvcc = kzalloc_obj(*pvcc);
 	if (pvcc == NULL)
 		return -ENOMEM;

base-commit: 70f3995830d3f1e79faa14eb0605914f778feca9
-- 
2.52.0