From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 14 Sep 2022 05:25:47 +0200
Subject: [PATCH] cifs: always initialize struct msghdr smb_msg completely
Git-commit: bedc8f76b3539ac4f952114b316bcc2251e808ce
References: bsc#1190317
Patch-mainline: v6.0-rc6
So far we were just lucky because the uninitialized members
of struct msghdr are not used by default on a SOCK_STREAM tcp
socket.
But as new things like msg_ubuf and sg_from_iter where added
recently, we should play on the safe side and avoid potention
problems in future.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Acked-by: Enzo Matsumiya <ematsumiya@suse.de>
---
fs/cifs/connect.c | 7 ++-----
fs/cifs/transport.c | 6 +-----
2 files changed, 3 insertions(+), 10 deletions(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -848,9 +848,6 @@ cifs_readv_from_socket(struct TCP_Server
int length = 0;
int total_read;
- smb_msg->msg_control = NULL;
- smb_msg->msg_controllen = 0;
-
for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
try_to_freeze();
@@ -901,7 +898,7 @@ int
cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
unsigned int to_read)
{
- struct msghdr smb_msg;
+ struct msghdr smb_msg = {};
struct kvec iov = {.iov_base = buf, .iov_len = to_read};
iov_iter_kvec(&smb_msg.msg_iter, READ | ITER_KVEC, &iov, 1, to_read);
@@ -912,7 +909,7 @@ int
cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,
unsigned int page_offset, unsigned int to_read)
{
- struct msghdr smb_msg;
+ struct msghdr smb_msg = {};
struct bio_vec bv = {
.bv_page = page, .bv_len = to_read, .bv_offset = page_offset};
iov_iter_bvec(&smb_msg.msg_iter, READ | ITER_BVEC, &bv, 1, to_read);
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -204,10 +204,6 @@ smb_send_kvec(struct TCP_Server_Info *se
*sent = 0;
- smb_msg->msg_name = NULL;
- smb_msg->msg_namelen = 0;
- smb_msg->msg_control = NULL;
- smb_msg->msg_controllen = 0;
if (server->noblocksnd)
smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
else
@@ -319,7 +315,7 @@ __smb_send_rqst(struct TCP_Server_Info *
sigset_t mask, oldmask;
size_t total_len = 0, sent, size;
struct socket *ssocket = server->ssocket;
- struct msghdr smb_msg;
+ struct msghdr smb_msg = {};
int val = 1;
__be32 rfc1002_marker;