Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-04 04:06:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ax25: uninitialized variable in ax25_setsockopt()

Browse Source 
The "opt" variable is unsigned long but we only copy 4 bytes from
the user so the lower 4 bytes are uninitialized.

I have changed the integer overflow checks from ULONG to UINT as well.
This is a slight API change but I don't expect it to break anything.

Fixes: a7b75c5a8c ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2022-01-07 10:13:12 +03:00 committed by David S. Miller
parent b69c5b5886
commit 9371937092
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/ax25/af_ax25.c
View File

@ -536,7 +536,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
ax25_cb *ax25;
struct net_device *dev;
char devname[IFNAMSIZ];
unsigned long opt;
unsigned int opt;
int res = 0;
if (level != SOL_AX25)
@ -568,7 +568,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T1:
if (opt < 1 || opt > ULONG_MAX / HZ) {
if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL;
break;
}
@ -577,7 +577,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T2:
if (opt < 1 || opt > ULONG_MAX / HZ) {
if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL;
break;
}
@ -593,7 +593,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T3:
if (opt < 1 || opt > ULONG_MAX / HZ) {
if (opt < 1 || opt > UINT_MAX / HZ) {
res = -EINVAL;
break;
}
@ -601,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_IDLE:
if (opt > ULONG_MAX / (60 * HZ)) {
if (opt > UINT_MAX / (60 * HZ)) {
res = -EINVAL;
break;
}