| Message ID | 1467364281-20251-1-git-send-email-richard.alpe@ericsson.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Richard Alpe <richard.alpe@ericsson.com> Date: Fri, 1 Jul 2016 11:11:21 +0200 > Fix incorrect use of nla_strlcpy() where the first NLA_HDRLEN bytes > of the link name where left out. > > Making the output of tipc-config -ls look something like: > Link statistics: > dcast-link > 1:data0-1.1.2:data0 > 1:data0-1.1.3:data0 > > Also, for the record, the patch that introduce this regression > claims "Sending the whole object out can cause a leak". Which isn't > very likely as this is a compat layer, where the data we are parsing > is generated by us and we know the string to be NULL terminated. But > you can of course never be to secure. > > Fixes: 5d2be1422e02 (tipc: fix an infoleak in tipc_nl_compat_link_dump) > Signed-off-by: Richard Alpe <richard.alpe@ericsson.com> Applied to 'net' since that is where the regression exists. Please submit bug fixes to the correct tree.
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index 3ad9fab..1fd4647 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -604,7 +604,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg, link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); - nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]), + nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME], TIPC_MAX_LINK_NAME); return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
Fix incorrect use of nla_strlcpy() where the first NLA_HDRLEN bytes of the link name where left out. Making the output of tipc-config -ls look something like: Link statistics: dcast-link 1:data0-1.1.2:data0 1:data0-1.1.3:data0 Also, for the record, the patch that introduce this regression claims "Sending the whole object out can cause a leak". Which isn't very likely as this is a compat layer, where the data we are parsing is generated by us and we know the string to be NULL terminated. But you can of course never be to secure. Fixes: 5d2be1422e02 (tipc: fix an infoleak in tipc_nl_compat_link_dump) Signed-off-by: Richard Alpe <richard.alpe@ericsson.com> --- net/tipc/netlink_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)