From 0cac442f7de21127af3189235d6a0ae50f8e1e72 Mon Sep 17 00:00:00 2001
From: Patrick McHardy <kaber@trash.net>
Date: Wed, 17 Mar 2010 06:04:14 +0000
Subject: [PATCH] --- yaml --- r: 188872 b: refs/heads/master c:
 a50436f2cd6e85794f7e1aad795ca8302177b896 h: refs/heads/master v: v3

---
 [refs]                 | 2 +-
 trunk/net/ipv4/ipmr.c  | 3 +++
 trunk/net/ipv6/ip6mr.c | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 6b1b134bdae7..6d0522ea209c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ea93fd9456ad32cd85b2d7914b58c6313cc40c9e
+refs/heads/master: a50436f2cd6e85794f7e1aad795ca8302177b896
diff --git a/trunk/net/ipv4/ipmr.c b/trunk/net/ipv4/ipmr.c
index 8582e12e4a62..0b9d03c54dc3 100644
--- a/trunk/net/ipv4/ipmr.c
+++ b/trunk/net/ipv4/ipmr.c
@@ -802,6 +802,9 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 	int line;
 	struct mfc_cache *uc, *c, **cp;
 
+	if (mfc->mfcc_parent >= MAXVIFS)
+		return -ENFILE;
+
 	line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
 	for (cp = &net->ipv4.mfc_cache_array[line];
diff --git a/trunk/net/ipv6/ip6mr.c b/trunk/net/ipv6/ip6mr.c
index 52e0f74fdfe0..23e4ac0cc30e 100644
--- a/trunk/net/ipv6/ip6mr.c
+++ b/trunk/net/ipv6/ip6mr.c
@@ -1113,6 +1113,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
 	unsigned char ttls[MAXMIFS];
 	int i;
 
+	if (mfc->mf6cc_parent >= MAXMIFS)
+		return -ENFILE;
+
 	memset(ttls, 255, MAXMIFS);
 	for (i = 0; i < MAXMIFS; i++) {
 		if (IF_ISSET(i, &mfc->mf6cc_ifset))