From: Jakub Kicinski <kuba@kernel.org>
Date: Tue, 12 Jan 2021 16:21:21 +0000 (+0100)
Subject: smc: fix out of bound access in smc_nl_get_sys_info()
X-Git-Tag: baikal/aarch64/sdk6.1~7477^2~17^2~1
X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=7b24a2bd74b81926d4a1ddc62d4ff106475ac819;p=kernel.git

smc: fix out of bound access in smc_nl_get_sys_info()

smc_clc_get_hostname() sets the host pointer to a buffer
which is not NULL-terminated (see smc_clc_init()).

Reported-by: syzbot+f4708c391121cfc58396@syzkaller.appspotmail.com
Fixes: e47932166c0e ("net/smc: Add support for obtaining system information")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 59342b519e347..8d866b4ed8f61 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -246,7 +246,8 @@ int smc_nl_get_sys_info(struct sk_buff *skb, struct netlink_callback *cb)
 		goto errattr;
 	smc_clc_get_hostname(&host);
 	if (host) {
-		snprintf(hostname, sizeof(hostname), "%s", host);
+		memcpy(hostname, host, SMC_MAX_HOSTNAME_LEN);
+		hostname[SMC_MAX_HOSTNAME_LEN] = 0;
 		if (nla_put_string(skb, SMC_NLA_SYS_LOCAL_HOST, hostname))
 			goto errattr;
 	}