diff options
| author | Karsten Graul <kgraul@linux.ibm.com> | 2022-04-08 17:10:33 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-20 09:36:15 +0200 |
| commit | a2027dcf197fc6c6dc745a3f197e13185fa9b5c1 (patch) | |
| tree | 588b61c34b1a487b55a775ab497d964343987822 | |
| parent | 833759b3aadbbe9137cf026236037c979a183756 (diff) | |
| download | linux-stable-a2027dcf197fc6c6dc745a3f197e13185fa9b5c1.tar.gz linux-stable-a2027dcf197fc6c6dc745a3f197e13185fa9b5c1.tar.bz2 linux-stable-a2027dcf197fc6c6dc745a3f197e13185fa9b5c1.zip | |
net/smc: use memcpy instead of snprintf to avoid out of bounds read
[ Upstream commit b1871fd48efc567650dbdc974e5a2342a03fe0d2 ]
Using snprintf() to convert not null-terminated strings to null
terminated strings may cause out of bounds read in the source string.
Therefore use memcpy() and terminate the target string with a null
afterwards.
Fixes: fa0866625543 ("net/smc: add support for user defined EIDs")
Fixes: 3c572145c24e ("net/smc: add generic netlink support for system EID")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/smc/smc_clc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index ce27399b38b1..f9f3f59c79de 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -191,7 +191,8 @@ static int smc_nl_ueid_dumpinfo(struct sk_buff *skb, u32 portid, u32 seq, flags, SMC_NETLINK_DUMP_UEID); if (!hdr) return -ENOMEM; - snprintf(ueid_str, sizeof(ueid_str), "%s", ueid); + memcpy(ueid_str, ueid, SMC_MAX_EID_LEN); + ueid_str[SMC_MAX_EID_LEN] = 0; if (nla_put_string(skb, SMC_NLA_EID_TABLE_ENTRY, ueid_str)) { genlmsg_cancel(skb, hdr); return -EMSGSIZE; @@ -252,7 +253,8 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb) goto end; smc_ism_get_system_eid(&seid); - snprintf(seid_str, sizeof(seid_str), "%s", seid); + memcpy(seid_str, seid, SMC_MAX_EID_LEN); + seid_str[SMC_MAX_EID_LEN] = 0; if (nla_put_string(skb, SMC_NLA_SEID_ENTRY, seid_str)) goto err; read_lock(&smc_clc_eid_table.lock); |