Messages in this thread Patch in this message | | | From | Haimin Zhang <> | Subject | [PATCH] net/ieee802154: fix uninit value bug in dgram_sendmsg | Date | Mon, 22 Aug 2022 15:19:02 +0800 |
| |
There is uninit value bug in dgram_sendmsg function in net/ieee802154/socket.c when the length of valid data pointed by the msg->msg_name isn't verified.
This length is specified by msg->msg_namelen. Function ieee802154_addr_from_sa is called by dgram_sendmsg, which use msg->msg_name as struct sockaddr_ieee802154* and read it, that will eventually lead to uninit value read. So we should check the length of msg->msg_name is not less than sizeof(struct sockaddr_ieee802154) before entering the ieee802154_addr_from_sa.
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com> --- net/ieee802154/socket.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index 718fb77bb..efbe08590 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -655,6 +655,10 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) if (msg->msg_name) { DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name); + if (msg->msg_namelen < sizeof(*daddr)) { + err = -EINVAL; + goto out_skb; + } ieee802154_addr_from_sa(&dst_addr, &daddr->addr); } else { -- 2.27.0
| |