Commit 93719370 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

ax25: uninitialized variable in ax25_setsockopt() 



The "opt" variable is unsigned long but we only copy 4 bytes from
the user so the lower 4 bytes are uninitialized.

I have changed the integer overflow checks from ULONG to UINT as well.
This is a slight API change but I don't expect it to break anything.

Fixes: a7b75c5a ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b69c5b58

net/ax25/af_ax25.c

+5 −5
Original line number Diff line number Diff line
@@ -536,7 +536,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
	ax25_cb *ax25;

	struct net_device *dev;

	char devname[IFNAMSIZ];

	unsigned long opt;

	unsigned int opt;

	int res = 0;



	if (level != SOL_AX25)
@@ -568,7 +568,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case AX25_T1:

		if (opt < 1 || opt > ULONG_MAX / HZ) {

		if (opt < 1 || opt > UINT_MAX / HZ) {

			res = -EINVAL;

			break;

		}
@@ -577,7 +577,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case AX25_T2:

		if (opt < 1 || opt > ULONG_MAX / HZ) {

		if (opt < 1 || opt > UINT_MAX / HZ) {

			res = -EINVAL;

			break;

		}
@@ -593,7 +593,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case AX25_T3:

		if (opt < 1 || opt > ULONG_MAX / HZ) {

		if (opt < 1 || opt > UINT_MAX / HZ) {

			res = -EINVAL;

			break;

		}
@@ -601,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case AX25_IDLE:

		if (opt > ULONG_MAX / (60 * HZ)) {

		if (opt > UINT_MAX / (60 * HZ)) {

			res = -EINVAL;

			break;

		}