diff options
| author | Guvenc Gulce <guvenc@linux.ibm.com> | 2021-01-12 19:21:22 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-01-13 07:22:01 +0300 |
| commit | 8a4465368964b4fbaf084760c94c7aabf61059fb (patch) | |
| tree | 06a00842a100de9d64eaac60c872e98a060714db /net/smc/smc_ism.c | |
| parent | 25fe2c9c4cd2e97c5f5b69f3aefe69aad3057936 (diff) | |
| download | linux-8a4465368964b4fbaf084760c94c7aabf61059fb.tar.xz | |
net/smc: use memcpy instead of snprintf to avoid out of bounds read
Using snprintf() to convert not null-terminated strings to null
terminated strings may cause out of bounds read in the source string.
Therefore use memcpy() and terminate the target string with a null
afterwards.
Fixes: a3db10efcc4c ("net/smc: Add support for obtaining SMCR device list")
Signed-off-by: Guvenc Gulce <guvenc@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/smc/smc_ism.c')
| -rw-r--r-- | net/smc/smc_ism.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c index 524ef64a191a..9c6e95882553 100644 --- a/net/smc/smc_ism.c +++ b/net/smc/smc_ism.c @@ -250,7 +250,8 @@ static int smc_nl_handle_smcd_dev(struct smcd_dev *smcd, goto errattr; if (nla_put_u8(skb, SMC_NLA_DEV_PORT_PNET_USR, smcd->pnetid_by_user)) goto errportattr; - snprintf(smc_pnet, sizeof(smc_pnet), "%s", smcd->pnetid); + memcpy(smc_pnet, smcd->pnetid, SMC_MAX_PNETID_LEN); + smc_pnet[SMC_MAX_PNETID_LEN] = 0; if (nla_put_string(skb, SMC_NLA_DEV_PORT_PNETID, smc_pnet)) goto errportattr; |