diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2021-01-12 17:21:21 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-01-12 20:22:01 -0800 |
| commit | 25fe2c9c4cd2e97c5f5b69f3aefe69aad3057936 (patch) | |
| tree | 09e27f006401b300b01ef8d4bcb890bbf6bbcdaf | |
| parent | 584c19f92754e9d590d75a94df66c47f7c4fd2cc (diff) | |
| download | linux-25fe2c9c4cd2e97c5f5b69f3aefe69aad3057936.tar.bz2 | |
smc: fix out of bound access in smc_nl_get_sys_info()
smc_clc_get_hostname() sets the host pointer to a buffer
which is not NULL-terminated (see smc_clc_init()).
Reported-by: syzbot+f4708c391121cfc58396@syzkaller.appspotmail.com
Fixes: 099b990bd11a ("net/smc: Add support for obtaining system information")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/smc/smc_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c index 59342b519e34..8d866b4ed8f6 100644 --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -246,7 +246,8 @@ int smc_nl_get_sys_info(struct sk_buff *skb, struct netlink_callback *cb) goto errattr; smc_clc_get_hostname(&host); if (host) { - snprintf(hostname, sizeof(hostname), "%s", host); + memcpy(hostname, host, SMC_MAX_HOSTNAME_LEN); + hostname[SMC_MAX_HOSTNAME_LEN] = 0; if (nla_put_string(skb, SMC_NLA_SYS_LOCAL_HOST, hostname)) goto errattr; } |