diff options
| author |   Guvenc Gulce <guvenc@linux.ibm.com> | 2021-01-12 17:21:22 +0100 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2021-01-12 20:22:01 -0800 |
| commit | 8a4465368964b4fbaf084760c94c7aabf61059fb (patch) | |
| tree | 06a00842a100de9d64eaac60c872e98a060714db /net/smc/smc_ib.c | |
| parent | smc: fix out of bound access in smc_nl_get_sys_info() (diff) | |
| download | linux-dev-8a4465368964b4fbaf084760c94c7aabf61059fb.tar.xz linux-dev-8a4465368964b4fbaf084760c94c7aabf61059fb.zip | |
net/smc: use memcpy instead of snprintf to avoid out of bounds read
Using snprintf() to convert not null-terminated strings to null
terminated strings may cause out of bounds read in the source string.
Therefore use memcpy() and terminate the target string with a null
afterwards.
Fixes: a3db10efcc4c ("net/smc: Add support for obtaining SMCR device list")
Signed-off-by: Guvenc Gulce <guvenc@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/smc/smc_ib.c')
| -rw-r--r-- | net/smc/smc_ib.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c index ddd7fac98b1d..7d7ba0320d5a 100644 --- a/net/smc/smc_ib.c +++ b/net/smc/smc_ib.c @@ -371,8 +371,8 @@ static int smc_nl_handle_dev_port(struct sk_buff *skb, if (nla_put_u8(skb, SMC_NLA_DEV_PORT_PNET_USR, smcibdev->pnetid_by_user[port])) goto errattr; - snprintf(smc_pnet, sizeof(smc_pnet), "%s", - (char *)&smcibdev->pnetid[port]); + memcpy(smc_pnet, &smcibdev->pnetid[port], SMC_MAX_PNETID_LEN); + smc_pnet[SMC_MAX_PNETID_LEN] = 0; if (nla_put_string(skb, SMC_NLA_DEV_PORT_PNETID, smc_pnet)) goto errattr; if (nla_put_u32(skb, SMC_NLA_DEV_PORT_NETDEV, @@ -414,7 +414,7 @@ static int smc_nl_handle_smcr_dev(struct smc_ib_device *smcibdev, struct sk_buff *skb, struct netlink_callback *cb) { - char smc_ibname[IB_DEVICE_NAME_MAX + 1]; + char smc_ibname[IB_DEVICE_NAME_MAX]; struct smc_pci_dev smc_pci_dev; struct pci_dev *pci_dev; unsigned char is_crit; |