Commit b1871fd4 authored by Karsten Graul's avatar Karsten Graul Committed by Jakub Kicinski
Browse files

net/smc: use memcpy instead of snprintf to avoid out of bounds read 



Using snprintf() to convert not null-terminated strings to null
terminated strings may cause out of bounds read in the source string.
Therefore use memcpy() and terminate the target string with a null
afterwards.

Fixes: fa086662 ("net/smc: add support for user defined EIDs")
Fixes: 3c572145 ("net/smc: add generic netlink support for system EID")
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5ad7f18c

net/smc/smc_clc.c

+4 −2
Original line number Diff line number Diff line
@@ -191,7 +191,8 @@ static int smc_nl_ueid_dumpinfo(struct sk_buff *skb, u32 portid, u32 seq, 
			  flags, SMC_NETLINK_DUMP_UEID);

	if (!hdr)

		return -ENOMEM;

	snprintf(ueid_str, sizeof(ueid_str), "%s", ueid);

	memcpy(ueid_str, ueid, SMC_MAX_EID_LEN);

	ueid_str[SMC_MAX_EID_LEN] = 0;

	if (nla_put_string(skb, SMC_NLA_EID_TABLE_ENTRY, ueid_str)) {

		genlmsg_cancel(skb, hdr);

		return -EMSGSIZE;
@@ -252,7 +253,8 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb) 
		goto end;



	smc_ism_get_system_eid(&seid);

	snprintf(seid_str, sizeof(seid_str), "%s", seid);

	memcpy(seid_str, seid, SMC_MAX_EID_LEN);

	seid_str[SMC_MAX_EID_LEN] = 0;

	if (nla_put_string(skb, SMC_NLA_SEID_ENTRY, seid_str))

		goto err;

	read_lock(&smc_clc_eid_table.lock);