ipv6: explicitly initialize udp6_addr in udp_sock_create6()

syzbot reported the use of uninitialized udp6_addr::sin6_scope_id.
We can just set ::sin6_scope_id to zero, as tunnels are unlikely
to use an IPv6 address that needs a scope id and there is no
interface to bind in this context.

For net-next, it looks different as we have cfg->bind_ifindex there
so we can probably call ipv6_iface_scope_id().

Same for ::sin6_flowinfo, tunnels don't use it.

Fixes: 8024e02879dd ("udp: Add udp_sock_create for UDP tunnels to open listener socket")
Reported-by: syzbot+c56449ed3652e6720f30@syzkaller.appspotmail.com
Cc: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index b283f293ee4ae7537da0bde51b5a4695a2e6f249..caad40d6e74d5c12b5215b0acda1f78e53da7955 100644 (file)
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -15,7 +15,7 @@
 int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
                     struct socket **sockp)
 {
-       struct sockaddr_in6 udp6_addr;
+       struct sockaddr_in6 udp6_addr = {};
        int err;
        struct socket *sock = NULL;
 
@@ -42,6 +42,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
                goto error;
 
        if (cfg->peer_udp_port) {
+               memset(&udp6_addr, 0, sizeof(udp6_addr));
                udp6_addr.sin6_family = AF_INET6;
                memcpy(&udp6_addr.sin6_addr, &cfg->peer_ip6,
                       sizeof(udp6_addr.sin6_addr));