diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2022-09-14 11:51:54 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-09-20 17:23:20 +0200 |
| commit | d547c1b717fc5a1e062307e1efdf81590ba9f6c1 (patch) | |
| tree | 65d6d01a042f32f6196b519b384fcf8b903d43b0 /net/compat.c | |
| parent | Merge branch 'ipmr-always-call-ip-6-_mr_forward-from-rcu-read-side-critical-s... (diff) | |
| download | linux-d547c1b717fc5a1e062307e1efdf81590ba9f6c1.tar.xz linux-d547c1b717fc5a1e062307e1efdf81590ba9f6c1.zip | |
net: clear msg_get_inq in __get_compat_msghdr()
syzbot is still complaining uninit-value in tcp_recvmsg(), for
commit 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and
__copy_msghdr_from_user()") missed that __get_compat_msghdr() is called
instead of copy_msghdr_from_user() when MSG_CMSG_COMPAT is specified.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()")
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/r/d06d0f7f-696c-83b4-b2d5-70b5f2730a37@I-love.SAKURA.ne.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/compat.c')
| -rw-r--r-- | net/compat.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/compat.c b/net/compat.c index fe9be3c56ef7..385f04a6be2f 100644 --- a/net/compat.c +++ b/net/compat.c @@ -52,6 +52,7 @@ int __get_compat_msghdr(struct msghdr *kmsg, kmsg->msg_namelen = sizeof(struct sockaddr_storage); kmsg->msg_control_is_user = true; + kmsg->msg_get_inq = 0; kmsg->msg_control_user = compat_ptr(msg->msg_control); kmsg->msg_controllen = msg->msg_controllen; |