diff options
| author | Jon Maloy <jon.maloy@ericsson.com> | 2018-04-12 02:15:48 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-04-13 04:55:38 +0300 |
| commit | 335b929b28aeb5bfc0698adb21deaf685b2982d1 (patch) | |
| tree | f6978c9de4fd5c6d35c0a4faf3400df5a29820c1 | |
| parent | 9d0c75bf6e03d9bf80c55b0f677dc9b982958fd5 (diff) | |
| download | linux-335b929b28aeb5bfc0698adb21deaf685b2982d1.tar.xz | |
tipc: fix missing initializer in tipc_sendmsg()
The stack variable 'dnode' in __tipc_sendmsg() may theoretically
end up tipc_node_get_mtu() as an unitilalized variable.
We fix this by intializing the variable at declaration. We also add
a default else clause to the two conditional ones already there, so
that we never end up in the named function if the given address
type is illegal.
Reported-by: syzbot+b0975ce9355b347c1546@syzkaller.appspotmail.com
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/tipc/socket.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 1fd1c8b5ce03..252a52ae0893 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1278,7 +1278,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen) struct tipc_msg *hdr = &tsk->phdr; struct tipc_name_seq *seq; struct sk_buff_head pkts; - u32 dnode, dport; + u32 dport, dnode = 0; u32 type, inst; int mtu, rc; @@ -1348,6 +1348,8 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen) msg_set_destnode(hdr, dnode); msg_set_destport(hdr, dest->addr.id.ref); msg_set_hdr_sz(hdr, BASIC_H_SIZE); + } else { + return -EINVAL; } /* Block or return if destination link is congested */ |