lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 179/191] ipvs: Fix uninit-value in do_ip_vs_set_ctl()
    Date
    From: Peilin Ye <yepeilin.cs@gmail.com>

    [ Upstream commit c5a8a8498eed1c164afc94f50a939c1a10abf8ad ]

    do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is
    zero. Fix it.

    Reported-by: syzbot+23b5f9e7caf61d9a3898@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?id=46ebfb92a8a812621a001ef04d90dfa459520fe2
    Suggested-by: Julian Anastasov <ja@ssi.bg>
    Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
    Acked-by: Julian Anastasov <ja@ssi.bg>
    Reviewed-by: Simon Horman <horms@verge.net.au>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/ipvs/ip_vs_ctl.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
    index 5ec80818ace2c..c1672ff009637 100644
    --- a/net/netfilter/ipvs/ip_vs_ctl.c
    +++ b/net/netfilter/ipvs/ip_vs_ctl.c
    @@ -2425,6 +2425,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
    /* Set timeout values for (tcp tcpfin udp) */
    ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
    goto out_unlock;
    + } else if (!len) {
    + /* No more commands with len == 0 below */
    + ret = -EINVAL;
    + goto out_unlock;
    }

    usvc_compat = (struct ip_vs_service_user *)arg;
    @@ -2501,9 +2505,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
    break;
    case IP_VS_SO_SET_DELDEST:
    ret = ip_vs_del_dest(svc, &udest);
    - break;
    - default:
    - ret = -EINVAL;
    }

    out_unlock:
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 15:19    [W:4.068 / U:0.480 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site