| Message ID | 1523488548-28520-1-git-send-email-jon.maloy@ericsson.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net,1/1] tipc: fix missing initializer in tipc_sendmsg() | expand |
From: Jon Maloy <jon.maloy@ericsson.com> Date: Thu, 12 Apr 2018 01:15:48 +0200 > The stack variable 'dnode' in __tipc_sendmsg() may theoretically > end up tipc_node_get_mtu() as an unitilalized variable. > > We fix this by intializing the variable at declaration. We also add > a default else clause to the two conditional ones already there, so > that we never end up in the named function if the given address > type is illegal. > > Reported-by: syzbot+b0975ce9355b347c1546@syzkaller.appspotmail.com > Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Applied, thanks Jon.
diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 1fd1c8b..252a52ae 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1278,7 +1278,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen) struct tipc_msg *hdr = &tsk->phdr; struct tipc_name_seq *seq; struct sk_buff_head pkts; - u32 dnode, dport; + u32 dport, dnode = 0; u32 type, inst; int mtu, rc; @@ -1348,6 +1348,8 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen) msg_set_destnode(hdr, dnode); msg_set_destport(hdr, dest->addr.id.ref); msg_set_hdr_sz(hdr, BASIC_H_SIZE); + } else { + return -EINVAL; } /* Block or return if destination link is congested */
The stack variable 'dnode' in __tipc_sendmsg() may theoretically end up tipc_node_get_mtu() as an unitilalized variable. We fix this by intializing the variable at declaration. We also add a default else clause to the two conditional ones already there, so that we never end up in the named function if the given address type is illegal. Reported-by: syzbot+b0975ce9355b347c1546@syzkaller.appspotmail.com Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> --- net/tipc/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)