github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 05:27:07 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ax25: uninitialized variable in ax25_setsockopt()

Browse Source 
[ Upstream commit 9371937092 ]

The "opt" variable is unsigned long but we only copy 4 bytes from
the user so the lower 4 bytes are uninitialized.

I have changed the integer overflow checks from ULONG to UINT as well.
This is a slight API change but I don't expect it to break anything.

Fixes: a7b75c5a8c ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2022-01-07 10:13:12 +03:00 committed by Greg Kroah-Hartman
parent 27e9910c45
commit 0d04479857
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/ax25/af_ax25.c
View File

@ -536,7 +536,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
ax25_cb *ax25; ax25_cb *ax25;
struct net_device *dev; struct net_device *dev;
char devname[IFNAMSIZ]; char devname[IFNAMSIZ];
unsigned long opt; unsigned int opt;
int res = 0; int res = 0;
if (level != SOL_AX25) if (level != SOL_AX25)
@ -568,7 +568,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T1: case AX25_T1:
if (opt < 1 || opt > ULONG_MAX / HZ) { if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
@ -577,7 +577,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T2: case AX25_T2:
if (opt < 1 || opt > ULONG_MAX / HZ) { if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
@ -593,7 +593,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T3: case AX25_T3:
if (opt < 1 || opt > ULONG_MAX / HZ) { if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
@ -601,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_IDLE: case AX25_IDLE:
if (opt > ULONG_MAX / (60 * HZ)) { if (opt > UINT_MAX / (60 * HZ)) {
res = -EINVAL; res = -EINVAL;
break; break;
} }