qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[s390] net/smc: use memcpy instead of snprintf to avoid out of bounds read 

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2044294
Upstream Status: https://github.com/torvalds/linux.git
Tested: by IBM
Build-info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=45951016
Conflicts: None

commit b1871fd48efc567650dbdc974e5a2342a03fe0d2
Author: Karsten Graul <kgraul@linux.ibm.com>
Date:   Fri Apr 8 17:10:33 2022 +0200

    net/smc: use memcpy instead of snprintf to avoid out of bounds read

    Using snprintf() to convert not null-terminated strings to null
    terminated strings may cause out of bounds read in the source string.
    Therefore use memcpy() and terminate the target string with a null
    afterwards.

    Fixes: fa0866625543 ("net/smc: add support for user defined EIDs")
    Fixes: 3c572145c24e ("net/smc: add generic netlink support for system EID")
    Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Tobias Huschle <thuschle@redhat.com>
This commit is contained in:
Tobias Huschle 2022-06-15 06:47:48 +02:00
parent a52964896f
commit e4a1e4abde
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/smc/smc_clc.c
View File

@ -191,7 +191,8 @@ static int smc_nl_ueid_dumpinfo(struct sk_buff *skb, u32 portid, u32 seq,
flags, SMC_NETLINK_DUMP_UEID);
if (!hdr)
return -ENOMEM;
snprintf(ueid_str, sizeof(ueid_str), "%s", ueid);
memcpy(ueid_str, ueid, SMC_MAX_EID_LEN);
ueid_str[SMC_MAX_EID_LEN] = 0;
if (nla_put_string(skb, SMC_NLA_EID_TABLE_ENTRY, ueid_str)) {
genlmsg_cancel(skb, hdr);
return -EMSGSIZE;
@ -252,7 +253,8 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb)
goto end;
smc_ism_get_system_eid(&seid);
snprintf(seid_str, sizeof(seid_str), "%s", seid);
memcpy(seid_str, seid, SMC_MAX_EID_LEN);
seid_str[SMC_MAX_EID_LEN] = 0;
if (nla_put_string(skb, SMC_NLA_SEID_ENTRY, seid_str))
goto err;
read_lock(&smc_clc_eid_table.lock);