Commit b9ed3928 authored by Shigeru Yoshida's avatar Shigeru Yoshida Committed by Liu Jian
Browse files

tipc: Return non-zero value from tipc_udp_addr2str() on error 

stable inclusion
from stable-v5.10.224
commit aa38bf74899de07cf70b50cd17f8ad45fb6654c8
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1T
CVE: CVE-2024-42284

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa38bf74899de07cf70b50cd17f8ad45fb6654c8



-------------------------------------------------

[ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ]

tipc_udp_addr2str() should return non-zero value if the UDP media
address is invalid. Otherwise, a buffer overflow access can occur in
tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
media address.

Fixes: d0f91938 ("tipc: add ip/udp media type")
Signed-off-by: default avatarShigeru Yoshida <syoshida@redhat.com>
Reviewed-by: default avatarTung Nguyen <tung.q.nguyen@endava.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 37fbb7ba

net/tipc/udp_media.c

+4 −1
Original line number Diff line number Diff line
@@ -129,8 +129,11 @@ static int tipc_udp_addr2str(struct tipc_media_addr *a, char *buf, int size) 
		snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port));

	else if (ntohs(ua->proto) == ETH_P_IPV6)

		snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port));

	else

	else {

		pr_err("Invalid UDP media address\n");

		return 1;

	}



	return 0;

}