forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

ax25: uninitialized variable in ax25_setsockopt()

Browse source 
[ Upstream commit 9371937092 ]

The "opt" variable is unsigned long but we only copy 4 bytes from
the user so the lower 4 bytes are uninitialized.

I have changed the integer overflow checks from ULONG to UINT as well.
This is a slight API change but I don't expect it to break anything.

Fixes: a7b75c5a8c ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2022-01-07 10:13:12 +03:00 • committed by Greg Kroah-Hartman
commit 0d04479857
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
net/ax25/af_ax25.c
View file

@ -536,7 +536,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
ax25_cb *ax25;
struct net_device *dev;
char devname[IFNAMSIZ];
unsigned long opt;
unsigned int opt;
int res = 0;
if (level != SOL_AX25)
@ -568,7 +568,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T1:
if (opt < 1 || opt > ULONG_MAX / HZ) {
if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL;
break;
}
@ -577,7 +577,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T2:
if (opt < 1 || opt > ULONG_MAX / HZ) {
if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL;
break;
}
@ -593,7 +593,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T3:
if (opt < 1 || opt > ULONG_MAX / HZ) {
if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL;
break;
}
@ -601,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_IDLE:
if (opt > ULONG_MAX / (60 * HZ)) {
if (opt > UINT_MAX / (60 * HZ)) {
res = -EINVAL;
break;
}