diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2019-04-12 06:54:05 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-12 13:25:03 -0400 |
| commit | a9107a14a9b9112775459ad291fc5de0f2513ce0 (patch) | |
| tree | 530a53f9a7d14a343682fa77c4fc96fcbbd02400 /net | |
| parent | d852be84770c0611f8b76bd7046c6a814c5b9f11 (diff) | |
rxrpc: Check address length before reading srx_service field
KMSAN will complain if valid address length passed to bind() is shorter
than sizeof(struct sockaddr_rxrpc) bytes.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/rxrpc/af_rxrpc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c index 96f2952bbdfd..c54dce3ca0dd 100644 --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c | |||
| @@ -135,7 +135,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len) | |||
| 135 | struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr; | 135 | struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr; |
| 136 | struct rxrpc_local *local; | 136 | struct rxrpc_local *local; |
| 137 | struct rxrpc_sock *rx = rxrpc_sk(sock->sk); | 137 | struct rxrpc_sock *rx = rxrpc_sk(sock->sk); |
| 138 | u16 service_id = srx->srx_service; | 138 | u16 service_id; |
| 139 | int ret; | 139 | int ret; |
| 140 | 140 | ||
| 141 | _enter("%p,%p,%d", rx, saddr, len); | 141 | _enter("%p,%p,%d", rx, saddr, len); |
| @@ -143,6 +143,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len) | |||
| 143 | ret = rxrpc_validate_address(rx, srx, len); | 143 | ret = rxrpc_validate_address(rx, srx, len); |
| 144 | if (ret < 0) | 144 | if (ret < 0) |
| 145 | goto error; | 145 | goto error; |
| 146 | service_id = srx->srx_service; | ||
| 146 | 147 | ||
| 147 | lock_sock(&rx->sk); | 148 | lock_sock(&rx->sk); |
| 148 | 149 | ||
