p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

smc: fix out of bound access in smc_nl_get_sys_info() 

smc_clc_get_hostname() sets the host pointer to a buffer
which is not NULL-terminated (see smc_clc_init()).

Reported-by: syzbot+f4708c391121cfc58396@syzkaller.appspotmail.com
Fixes: 099b990bd1 ("net/smc: Add support for obtaining system information")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2021-01-12 17:21:21 +01:00
parent 584c19f927
commit 25fe2c9c4c
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/smc/smc_core.c
View File

@ -246,7 +246,8 @@ int smc_nl_get_sys_info(struct sk_buff *skb, struct netlink_callback *cb)
goto errattr; goto errattr;
smc_clc_get_hostname(&host); smc_clc_get_hostname(&host);
if (host) { if (host) {
snprintf(hostname, sizeof(hostname), "%s", host); memcpy(hostname, host, SMC_MAX_HOSTNAME_LEN);
hostname[SMC_MAX_HOSTNAME_LEN] = 0;
if (nla_put_string(skb, SMC_NLA_SYS_LOCAL_HOST, hostname)) if (nla_put_string(skb, SMC_NLA_SYS_LOCAL_HOST, hostname))
goto errattr; goto errattr;
} }