mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 08:46:46 +00:00
sctp: allocate sctp_sockaddr_entry with kzalloc
commit400b8b9a2a
upstream. The similar issue as fixed in Commit4a2eb0c37b
("sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event") also exists in sctp_inetaddr_event, as Alexander noticed. To fix it, allocate sctp_sockaddr_entry with kzalloc for both sctp ipv4 and ipv6 addresses, as does in sctp_v4/6_copy_addrlist(). Reported-by: Alexander Potapenko <glider@google.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Reported-by: syzbot+ae0c70c0c2d40c51bb92@syzkaller.appspotmail.com Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
0fb89795bb
commit
81b2fee6eb
2 changed files with 2 additions and 7 deletions
|
@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
|
||||||
|
|
||||||
switch (ev) {
|
switch (ev) {
|
||||||
case NETDEV_UP:
|
case NETDEV_UP:
|
||||||
addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
|
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
||||||
if (addr) {
|
if (addr) {
|
||||||
addr->a.v6.sin6_family = AF_INET6;
|
addr->a.v6.sin6_family = AF_INET6;
|
||||||
addr->a.v6.sin6_port = 0;
|
|
||||||
addr->a.v6.sin6_flowinfo = 0;
|
|
||||||
addr->a.v6.sin6_addr = ifa->addr;
|
addr->a.v6.sin6_addr = ifa->addr;
|
||||||
addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
|
addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
|
||||||
addr->valid = 1;
|
addr->valid = 1;
|
||||||
|
@ -415,7 +413,6 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
|
||||||
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
||||||
if (addr) {
|
if (addr) {
|
||||||
addr->a.v6.sin6_family = AF_INET6;
|
addr->a.v6.sin6_family = AF_INET6;
|
||||||
addr->a.v6.sin6_port = 0;
|
|
||||||
addr->a.v6.sin6_addr = ifp->addr;
|
addr->a.v6.sin6_addr = ifp->addr;
|
||||||
addr->a.v6.sin6_scope_id = dev->ifindex;
|
addr->a.v6.sin6_scope_id = dev->ifindex;
|
||||||
addr->valid = 1;
|
addr->valid = 1;
|
||||||
|
|
|
@ -151,7 +151,6 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
|
||||||
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
||||||
if (addr) {
|
if (addr) {
|
||||||
addr->a.v4.sin_family = AF_INET;
|
addr->a.v4.sin_family = AF_INET;
|
||||||
addr->a.v4.sin_port = 0;
|
|
||||||
addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
|
addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
|
||||||
addr->valid = 1;
|
addr->valid = 1;
|
||||||
INIT_LIST_HEAD(&addr->list);
|
INIT_LIST_HEAD(&addr->list);
|
||||||
|
@ -782,10 +781,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
|
||||||
|
|
||||||
switch (ev) {
|
switch (ev) {
|
||||||
case NETDEV_UP:
|
case NETDEV_UP:
|
||||||
addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
|
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
||||||
if (addr) {
|
if (addr) {
|
||||||
addr->a.v4.sin_family = AF_INET;
|
addr->a.v4.sin_family = AF_INET;
|
||||||
addr->a.v4.sin_port = 0;
|
|
||||||
addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
|
addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
|
||||||
addr->valid = 1;
|
addr->valid = 1;
|
||||||
spin_lock_bh(&net->sctp.local_addr_lock);
|
spin_lock_bh(&net->sctp.local_addr_lock);
|
||||||
|
|
Loading…
Reference in a new issue