From nobody Thu Dec 18 04:30:53 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4EDFCDB47E for ; Fri, 13 Oct 2023 07:05:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229798AbjJMHF3 (ORCPT ); Fri, 13 Oct 2023 03:05:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229726AbjJMHF1 (ORCPT ); Fri, 13 Oct 2023 03:05:27 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.199]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id C5FC5B7; Fri, 13 Oct 2023 00:05:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=frMwB +yQcrqfw7+mUC1RLpFWBfRdjTmzx1BGRb9nPkY=; b=bgcKwGfHHQLttJDR/zMLu yNDKelR5y7v871iubA92RBIKiOGPXIx2bs5JZcWRTJLe1NANMVqZXPh7HiFJ7AQo CNTJHEsYpvnCmyWhHsIaaeGFw7oBGh8BFTH5/bqD95iE+A4nm/b3/imnEO9W2WmK sZeR1GX1E1p6kIW6BZiqvs= Received: from icess-ProLiant-DL380-Gen10.. (unknown [183.174.60.14]) by zwqz-smtp-mta-g4-4 (Coremail) with SMTP id _____wD3_9Dr6yhlQ_y2AQ--.20479S4; Fri, 13 Oct 2023 15:04:20 +0800 (CST) From: Ma Ke To: jmaloy@redhat.com, ying.xue@windriver.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, Ma Ke Subject: [PATCH] tipc: Fix uninit-value access in tipc_nl_node_get_link() Date: Fri, 13 Oct 2023 15:04:08 +0800 Message-Id: <20231013070408.1979343-1-make_ruc2021@163.com> X-Mailer: git-send-email 2.37.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wD3_9Dr6yhlQ_y2AQ--.20479S4 X-Coremail-Antispam: 1Uf129KBjvdXoW7Wr4rCw4ktrW5WFyxJFW8WFg_yoWfJFX_Z3 92g3yfAry8J39Yyr4DXa95JrZ3Jan8G3Z5uw1akryUK34DCrWrZan5JFn8CrW3urZ7u3sr Ga40vF1fXF12qjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRMg4SUUUUUU== X-Originating-IP: [183.174.60.14] X-CM-SenderInfo: 5pdnvshuxfjiisr6il2tof0z/1tbivggIC1ZcjGryowAAsI Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Names must be null-terminated strings. If a name which is not=20 null-terminated is passed through netlink, strstr() and similar=20 functions can cause buffer overrun. This patch fixes this issue=20 by returning -EINVAL if a non-null-terminated name is passed. Signed-off-by: Ma Ke --- net/tipc/node.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/tipc/node.c b/net/tipc/node.c index 3105abe97bb9..a02bcd7e07d3 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -2519,6 +2519,9 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct= genl_info *info) return -EINVAL; =20 name =3D nla_data(attrs[TIPC_NLA_LINK_NAME]); + if (name[strnlen(name, + nla_len(attrs[TIPC_NLA_LINK_NAME]))] !=3D '\0') + return -EINVAL; =20 msg.skb =3D nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); if (!msg.skb) --=20 2.37.2