Commit f58c7ab3 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Litao Jiao
Browse files

smc: fix out of bound access in smc_nl_get_sys_info() 

mainline inclusion
from mainline-v5.11-rc4
commit 25fe2c9c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I78IFM
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=25fe2c9c4cd2e97c5f5b69f3aefe69aad3057936



--------------------------------

smc_clc_get_hostname() sets the host pointer to a buffer
which is not NULL-terminated (see smc_clc_init()).

Reported-by: default avatar <syzbot+f4708c391121cfc58396@syzkaller.appspotmail.com>
Fixes: 099b990b ("net/smc: Add support for obtaining system information")
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarYingyu Zeng <zengyingyu@sangfor.com.cn>
parent 0d3d08fe

net/smc/smc_core.c

+2 −1
Original line number Diff line number Diff line
@@ -248,7 +248,8 @@ int smc_nl_get_sys_info(struct sk_buff *skb, struct netlink_callback *cb) 
		goto errattr;

	smc_clc_get_hostname(&host);

	if (host) {

		snprintf(hostname, sizeof(hostname), "%s", host);

		memcpy(hostname, host, SMC_MAX_HOSTNAME_LEN);

		hostname[SMC_MAX_HOSTNAME_LEN] = 0;

		if (nla_put_string(skb, SMC_NLA_SYS_LOCAL_HOST, hostname))

			goto errattr;

	}