lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 353/846] ax25: uninitialized variable in ax25_setsockopt()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 9371937092d5fd502032c1bb4475b36b39b1f1b3 ]

    The "opt" variable is unsigned long but we only copy 4 bytes from
    the user so the lower 4 bytes are uninitialized.

    I have changed the integer overflow checks from ULONG to UINT as well.
    This is a slight API change but I don't expect it to break anything.

    Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ax25/af_ax25.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    index aa7785687e757..7473e0cc6d469 100644
    --- a/net/ax25/af_ax25.c
    +++ b/net/ax25/af_ax25.c
    @@ -536,7 +536,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    ax25_cb *ax25;
    struct net_device *dev;
    char devname[IFNAMSIZ];
    - unsigned long opt;
    + unsigned int opt;
    int res = 0;

    if (level != SOL_AX25)
    @@ -568,7 +568,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_T1:
    - if (opt < 1 || opt > ULONG_MAX / HZ) {
    + if (opt < 1 || opt > UINT_MAX / HZ) {
    res = -EINVAL;
    break;
    }
    @@ -577,7 +577,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_T2:
    - if (opt < 1 || opt > ULONG_MAX / HZ) {
    + if (opt < 1 || opt > UINT_MAX / HZ) {
    res = -EINVAL;
    break;
    }
    @@ -593,7 +593,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_T3:
    - if (opt < 1 || opt > ULONG_MAX / HZ) {
    + if (opt < 1 || opt > UINT_MAX / HZ) {
    res = -EINVAL;
    break;
    }
    @@ -601,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_IDLE:
    - if (opt > ULONG_MAX / (60 * HZ)) {
    + if (opt > UINT_MAX / (60 * HZ)) {
    res = -EINVAL;
    break;
    }
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 00:11    [W:4.229 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site