system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-20 19:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

net/smc: use memcpy instead of snprintf to avoid out of bounds read

Browse source 
Using snprintf() to convert not null-terminated strings to null
terminated strings may cause out of bounds read in the source string.
Therefore use memcpy() and terminate the target string with a null
afterwards.

Fixes: fa08666255 ("net/smc: add support for user defined EIDs")
Fixes: 3c572145c2 ("net/smc: add generic netlink support for system EID")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Karsten Graul 2022-04-08 17:10:33 +02:00 committed by Jakub Kicinski
parent 5ad7f18cd8
commit b1871fd48e
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
net/smc/smc_clc.c
View file

@ -191,7 +191,8 @@ static int smc_nl_ueid_dumpinfo(struct sk_buff *skb, u32 portid, u32 seq,
flags, SMC_NETLINK_DUMP_UEID); flags, SMC_NETLINK_DUMP_UEID);
if (!hdr) if (!hdr)
return -ENOMEM; return -ENOMEM;
snprintf(ueid_str, sizeof(ueid_str), "%s", ueid); memcpy(ueid_str, ueid, SMC_MAX_EID_LEN);
ueid_str[SMC_MAX_EID_LEN] = 0;
if (nla_put_string(skb, SMC_NLA_EID_TABLE_ENTRY, ueid_str)) { if (nla_put_string(skb, SMC_NLA_EID_TABLE_ENTRY, ueid_str)) {
genlmsg_cancel(skb, hdr); genlmsg_cancel(skb, hdr);
return -EMSGSIZE; return -EMSGSIZE;
@ -252,7 +253,8 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb)
goto end; goto end;
smc_ism_get_system_eid(&seid); smc_ism_get_system_eid(&seid);
snprintf(seid_str, sizeof(seid_str), "%s", seid); memcpy(seid_str, seid, SMC_MAX_EID_LEN);
seid_str[SMC_MAX_EID_LEN] = 0;
if (nla_put_string(skb, SMC_NLA_SEID_ENTRY, seid_str)) if (nla_put_string(skb, SMC_NLA_SEID_ENTRY, seid_str))
goto err; goto err;
read_lock(&smc_clc_eid_table.lock); read_lock(&smc_clc_eid_table.lock);