Commit fb242745 authored Dec 18, 2018 by Cong Wang Committed by David S. Miller Dec 19, 2018

ipv6: explicitly initialize udp6_addr in udp_sock_create6()



syzbot reported the use of uninitialized udp6_addr::sin6_scope_id.
We can just set ::sin6_scope_id to zero, as tunnels are unlikely
to use an IPv6 address that needs a scope id and there is no
interface to bind in this context.

For net-next, it looks different as we have cfg->bind_ifindex there
so we can probably call ipv6_iface_scope_id().

Same for ::sin6_flowinfo, tunnels don't use it.

Fixes: 8024e028 ("udp: Add udp_sock_create for UDP tunnels to open listener socket")
Reported-by:  <syzbot+c56449ed3652e6720f30@syzkaller.appspotmail.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 84404d5f

net/ipv6/ip6_udp_tunnel.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -15,7 +15,7 @@
		int udp_sock_create6(struct net net, struct udp_port_cfg cfg,
		struct socket **sockp)
		{
		struct sockaddr_in6 udp6_addr;
		struct sockaddr_in6 udp6_addr = {};
		int err;
		struct socket *sock = NULL;

		@@ -42,6 +42,7 @@ int udp_sock_create6(struct net net, struct udp_port_cfg cfg,
		goto error;

		if (cfg->peer_udp_port) {
		memset(&udp6_addr, 0, sizeof(udp6_addr));
		udp6_addr.sin6_family = AF_INET6;
		memcpy(&udp6_addr.sin6_addr, &cfg->peer_ip6,
		sizeof(udp6_addr.sin6_addr));

Admin message