Merge branch 'net-fix-uninit-values-in-networking-stack'

Eric Dumazet says:

====================
net: fix uninit-values in networking stack

It seems syzbot got new features enabled, and fired some interesting
reports. Oh well.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

10 files changed, 20 insertions, 12 deletions

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index c49766b03165..7846c0c20cfe 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -158,16 +158,16 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         void *private;
         int err;
 
-        /* If caller uses non-allowed flag, return error. */
-        if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed))
-                return -EINVAL;
-
         if (sock->state == SS_CONNECTED)
                 return -EINVAL;
 
         if (addr_len < sizeof(*sa))
                 return -EINVAL;
 
+        /* If caller uses non-allowed flag, return error. */
+        if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed))
+                return -EINVAL;
+
         sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
         sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
 
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 899495589a7e..c7be1ca8e562 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -43,6 +43,7 @@ struct inet_timewait_sock {
 #define tw_family               __tw_common.skc_family
 #define tw_state                __tw_common.skc_state
 #define tw_reuse                __tw_common.skc_reuse
+#define tw_reuseport            __tw_common.skc_reuseport
 #define tw_ipv6only             __tw_common.skc_ipv6only
 #define tw_bound_dev_if         __tw_common.skc_bound_dev_if
 #define tw_node                 __tw_common.skc_nulls_node
diff --git a/include/net/nexthop.h b/include/net/nexthop.h
index 36bb794f5cd6..902ff382a6dc 100644
--- a/include/net/nexthop.h
+++ b/include/net/nexthop.h
@@ -7,7 +7,7 @@
 
 static inline int rtnh_ok(const struct rtnexthop *rtnh, int remaining)
 {
-        return remaining >= sizeof(*rtnh) &&
+        return remaining >= (int)sizeof(*rtnh) &&
                rtnh->rtnh_len >= sizeof(*rtnh) &&
                rtnh->rtnh_len <= remaining;
 }
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index c0548d268e1a..e3e6a3e2ca22 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -57,8 +57,8 @@ static int __hw_addr_add_ex(struct netdev_hw_addr_list *list,
                 return -EINVAL;
 
         list_for_each_entry(ha, &list->list, list) {
-                if (!memcmp(ha->addr, addr, addr_len) &&
-                    ha->type == addr_type) {
+                if (ha->type == addr_type &&
+                    !memcmp(ha->addr, addr, addr_len)) {
                         if (global) {
                                 /* check if addr is already used as global */
                                 if (ha->global_use)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1bca1e0fc8f7..345b51837ca8 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -857,6 +857,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
         n->cloned = 1;
         n->nohdr = 0;
+        n->peeked = 0;
         n->destructor = NULL;
         C(tail);
         C(end);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index e65fcb45c3f6..b08feb219b44 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -614,6 +614,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
         sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
+        ireq->ir_mark = inet_request_mark(sk, skb);
         ireq->ireq_family = AF_INET;
         ireq->ir_iif = sk->sk_bound_dev_if;
 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 5df7857fc0f3..6344f1b18a6a 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -351,6 +351,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
         ireq->ireq_family = AF_INET6;
+        ireq->ir_mark = inet_request_mark(sk, skb);
 
         if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) ||
             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index c3ea4906d237..88c5069b5d20 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -178,6 +178,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
                 tw->tw_dport        = inet->inet_dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
+                tw->tw_reuseport    = sk->sk_reuseport;
                 tw->tw_hash         = sk->sk_hash;
                 tw->tw_ipv6only     = 0;
                 tw->tw_transparent  = inet->transparent;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8322e479f299..59bc6ab1a4eb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2297,13 +2297,14 @@ struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
                                         const struct sk_buff *skb)
 {
         __u8 tos = RT_FL_TOS(fl4);
-        struct fib_result res;
+        struct fib_result res = {
+                .type           = RTN_UNSPEC,
+                .fi             = NULL,
+                .table          = NULL,
+                .tclassid       = 0,
+        };
         struct rtable *rth;
 
-        res.tclassid    = 0;
-        res.fi          = NULL;
-        res.table       = NULL;
-
         fl4->flowi4_iif = LOOPBACK_IFINDEX;
         fl4->flowi4_tos = tos & IPTOS_RT_MASK;
         fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index fa556fdef57d..55342c4d5cec 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1844,6 +1844,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 
         if (msg->msg_namelen) {
                 err = -EINVAL;
+                if (msg->msg_namelen < sizeof(struct sockaddr_nl))
+                        goto out;
                 if (addr->nl_family != AF_NETLINK)
                         goto out;
                 dst_portid = addr->nl_pid;