Commit c5a8a849 authored by Peilin Ye's avatar Peilin Ye Committed by Pablo Neira Ayuso
Browse files

ipvs: Fix uninit-value in do_ip_vs_set_ctl() 



do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is
zero. Fix it.

Reported-by: default avatar <syzbot+23b5f9e7caf61d9a3898@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?id=46ebfb92a8a812621a001ef04d90dfa459520fe2


Suggested-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarPeilin Ye <yepeilin.cs@gmail.com>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Reviewed-by: default avatarSimon Horman <horms@verge.net.au>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d5608a05

net/netfilter/ipvs/ip_vs_ctl.c

+4 −3
Original line number Diff line number Diff line
@@ -2508,6 +2508,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, sockptr_t ptr, unsigned int len) 
		/* Set timeout values for (tcp tcpfin udp) */

		ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);

		goto out_unlock;

	} else if (!len) {

		/* No more commands with len == 0 below */

		ret = -EINVAL;

		goto out_unlock;

	}



	usvc_compat = (struct ip_vs_service_user *)arg;
@@ -2584,9 +2588,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, sockptr_t ptr, unsigned int len) 
		break;

	case IP_VS_SO_SET_DELDEST:

		ret = ip_vs_del_dest(svc, &udest);

		break;

	default:

		ret = -EINVAL;

	}



  out_unlock: