diff options
author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2019-04-12 06:54:05 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2019-04-12 13:25:03 -0400 |
commit | a9107a14a9b9112775459ad291fc5de0f2513ce0 (patch) | |
tree | 530a53f9a7d14a343682fa77c4fc96fcbbd02400 /net/rxrpc | |
parent | d852be84770c0611f8b76bd7046c6a814c5b9f11 (diff) |
rxrpc: Check address length before reading srx_service field
KMSAN will complain if valid address length passed to bind() is shorter
than sizeof(struct sockaddr_rxrpc) bytes.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rxrpc')
-rw-r--r-- | net/rxrpc/af_rxrpc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c index 96f2952bbdfd..c54dce3ca0dd 100644 --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c | |||
@@ -135,7 +135,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len) | |||
135 | struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr; | 135 | struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr; |
136 | struct rxrpc_local *local; | 136 | struct rxrpc_local *local; |
137 | struct rxrpc_sock *rx = rxrpc_sk(sock->sk); | 137 | struct rxrpc_sock *rx = rxrpc_sk(sock->sk); |
138 | u16 service_id = srx->srx_service; | 138 | u16 service_id; |
139 | int ret; | 139 | int ret; |
140 | 140 | ||
141 | _enter("%p,%p,%d", rx, saddr, len); | 141 | _enter("%p,%p,%d", rx, saddr, len); |
@@ -143,6 +143,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len) | |||
143 | ret = rxrpc_validate_address(rx, srx, len); | 143 | ret = rxrpc_validate_address(rx, srx, len); |
144 | if (ret < 0) | 144 | if (ret < 0) |
145 | goto error; | 145 | goto error; |
146 | service_id = srx->srx_service; | ||
146 | 147 | ||
147 | lock_sock(&rx->sk); | 148 | lock_sock(&rx->sk); |
148 | 149 | ||