Commit 4f010246 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Daniel Borkmann

net/bpfilter: Initialize pos in __bpfilter_process_sockopt

__bpfilter_process_sockopt never initialized the pos variable passed
to the pipe write. This has been mostly harmless in the past as pipes
ignore the offset, but the switch to kernel_write now verified the
position, which can lead to a failure depending on the exact stack
initialization pattern. Initialize the variable to zero to make
rw_verify_area happy.

Fixes: 6955a76f ("bpfilter: switch to kernel_write")
Reported-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Reported-by: default avatarRodrigo Madera <rodrigo.madera@gmail.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Tested-by: default avatarRodrigo Madera <rodrigo.madera@gmail.com>
Tested-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/bpf/20200730160900.187157-1-hch@lst.de
parent 0ba58348
...@@ -39,7 +39,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname, ...@@ -39,7 +39,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
{ {
struct mbox_request req; struct mbox_request req;
struct mbox_reply reply; struct mbox_reply reply;
loff_t pos; loff_t pos = 0;
ssize_t n; ssize_t n;
int ret = -EFAULT; int ret = -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment