mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-28 21:33:52 +00:00
Code Issues Releases Wiki Activity

ax25: uninitialized variable in ax25_setsockopt()

Browse source 
The "opt" variable is unsigned long but we only copy 4 bytes from
the user so the lower 4 bytes are uninitialized.

I have changed the integer overflow checks from ULONG to UINT as well.
This is a slight API change but I don't expect it to break anything.

Fixes: a7b75c5a8c ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2022-01-07 10:13:12 +03:00 committed by David S. Miller
parent b69c5b5886
commit 9371937092
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
net/ax25/af_ax25.c
View file

@ -536,7 +536,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
ax25_cb *ax25; ax25_cb *ax25;
struct net_device *dev; struct net_device *dev;
char devname[IFNAMSIZ]; char devname[IFNAMSIZ];
unsigned long opt; unsigned int opt;
int res = 0; int res = 0;
if (level != SOL_AX25) if (level != SOL_AX25)
@ -568,7 +568,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T1: case AX25_T1:
if (opt < 1 || opt > ULONG_MAX / HZ) { if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
@ -577,7 +577,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T2: case AX25_T2:
if (opt < 1 || opt > ULONG_MAX / HZ) { if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
@ -593,7 +593,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T3: case AX25_T3:
if (opt < 1 || opt > ULONG_MAX / HZ) { if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
@ -601,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_IDLE: case AX25_IDLE:
if (opt > ULONG_MAX / (60 * HZ)) { if (opt > UINT_MAX / (60 * HZ)) {
res = -EINVAL; res = -EINVAL;
break; break;
} }