VServer 1.9.2 (patch-2.6.8.1-vs1.9.2.diff)

[linux-2.6.git] / net / ipv4 / ipconfig.c

diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index a5322ad..92db76f 100644 (file)
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -183,7 +183,14 @@ static int __init ic_open_devs(void)
 
        last = &ic_first_dev;
        rtnl_shlock();
+
+       /* bring loopback device up first */
+       if (dev_change_flags(&loopback_dev, loopback_dev.flags | IFF_UP) < 0)
+               printk(KERN_ERR "IP-Config: Failed to open %s\n", loopback_dev.name);
+
        for (dev = dev_base; dev; dev = dev->next) {
+               if (dev == &loopback_dev)
+                       continue;
                if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
                    (!(dev->flags & IFF_LOOPBACK) &&
                     (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
@@ -272,7 +279,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
 
        mm_segment_t oldfs = get_fs();
        set_fs(get_ds());
-       res = devinet_ioctl(cmd, arg);
+       res = devinet_ioctl(cmd, (struct ifreq __user *) arg);
        set_fs(oldfs);
        return res;
 }
@@ -283,7 +290,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
 
        mm_segment_t oldfs = get_fs();
        set_fs(get_ds());
-       res = ip_rt_ioctl(cmd, arg);
+       res = ip_rt_ioctl(cmd, (void __user *) arg);
        set_fs(oldfs);
        return res;
 }
@@ -818,7 +825,7 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
        struct bootp_pkt *b;
        struct iphdr *h;
        struct ic_device *d;
-       int len;
+       int len, ext_len;
 
        /* Perform verifications before taking the lock.  */
        if (skb->pkt_type == PACKET_OTHERHOST)
@@ -859,7 +866,11 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
                goto drop;
 
        len = ntohs(b->udph.len) - sizeof(struct udphdr);
-       if (len < 300)
+       ext_len = len - (sizeof(*b) -
+                        sizeof(struct iphdr) -
+                        sizeof(struct udphdr) -
+                        sizeof(b->exten));
+       if (ext_len < 0)
                goto drop;
 
        /* Ok the front looks good, make sure we can get at the rest.  */
@@ -894,7 +905,8 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
        }
 
        /* Parse extensions */
-       if (!memcmp(b->exten, ic_bootp_cookie, 4)) { /* Check magic cookie */
+       if (ext_len >= 4 &&
+           !memcmp(b->exten, ic_bootp_cookie, 4)) { /* Check magic cookie */
                 u8 *end = (u8 *) b + ntohs(b->iph.tot_len);
                u8 *ext;