Commit c68e747d authored by Tetsuo Handa's avatar Tetsuo Handa Committed by David S. Miller

llc: Check address length before reading address field

KMSAN will complain if valid address length passed to bind() is shorter
than sizeof(struct sockaddr_llc) bytes.
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bd7d46dd
...@@ -320,14 +320,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) ...@@ -320,14 +320,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
struct llc_sap *sap; struct llc_sap *sap;
int rc = -EINVAL; int rc = -EINVAL;
dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
lock_sock(sk); lock_sock(sk);
if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
goto out; goto out;
rc = -EAFNOSUPPORT; rc = -EAFNOSUPPORT;
if (unlikely(addr->sllc_family != AF_LLC)) if (unlikely(addr->sllc_family != AF_LLC))
goto out; goto out;
dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
rc = -ENODEV; rc = -ENODEV;
rcu_read_lock(); rcu_read_lock();
if (sk->sk_bound_dev_if) { if (sk->sk_bound_dev_if) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment