diff options
| author | Wei Yongjun <weiyongjun1@huawei.com> | 2018-03-13 03:03:30 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-03-13 10:45:11 -0400 |
| commit | d98985dd6c2dc69e2ad5f5482a5237fb9487ed99 (patch) | |
| tree | 21097e43f65b8a39a64c823d1b1edd26d4d42574 /net/sctp | |
| parent | 7083a45ad0df78546b3a735f0090b075efdf44e3 (diff) | |
| download | linux-d98985dd6c2dc69e2ad5f5482a5237fb9487ed99.tar.gz linux-d98985dd6c2dc69e2ad5f5482a5237fb9487ed99.tar.bz2 linux-d98985dd6c2dc69e2ad5f5482a5237fb9487ed99.zip | |
sctp: fix error return code in sctp_sendmsg_new_asoc()
Return error code -EINVAL in the address len check error handling
case since 'err' can be overwrite to 0 by 'err = sctp_verify_addr()'
in the for loop.
Fixes: 2c0dbaa0c43d ("sctp: add support for SCTP_DSTADDRV4/6 Information for sendmsg")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp')
| -rw-r--r-- | net/sctp/socket.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 7d3476a4860d..af5cf29b0c65 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1677,7 +1677,7 @@ static int sctp_sendmsg_new_asoc(struct sock *sk, __u16 sflags, struct sctp_association *asoc; enum sctp_scope scope; struct cmsghdr *cmsg; - int err = -EINVAL; + int err; *tp = NULL; @@ -1761,16 +1761,20 @@ static int sctp_sendmsg_new_asoc(struct sock *sk, __u16 sflags, memset(daddr, 0, sizeof(*daddr)); dlen = cmsg->cmsg_len - sizeof(struct cmsghdr); if (cmsg->cmsg_type == SCTP_DSTADDRV4) { - if (dlen < sizeof(struct in_addr)) + if (dlen < sizeof(struct in_addr)) { + err = -EINVAL; goto free; + } dlen = sizeof(struct in_addr); daddr->v4.sin_family = AF_INET; daddr->v4.sin_port = htons(asoc->peer.port); memcpy(&daddr->v4.sin_addr, CMSG_DATA(cmsg), dlen); } else { - if (dlen < sizeof(struct in6_addr)) + if (dlen < sizeof(struct in6_addr)) { + err = -EINVAL; goto free; + } dlen = sizeof(struct in6_addr); daddr->v6.sin6_family = AF_INET6; |