Skip to content

Commit

Permalink
net/af_iucv: right-size the uid variable in iucv_sock_bind()
Browse files Browse the repository at this point in the history
smatch complains about
net/iucv/af_iucv.c:624 iucv_sock_bind() error: memcpy() 'sa->siucv_user_id' too small (8 vs 9)

Which is absolutely correct - the memcpy() takes 9 bytes (sizeof(uid))
from an 8-byte field (sa->siucv_user_id).
Luckily the sockaddr_iucv struct contains more data after the
.siucv_user_id field, and we checked the size of the passed data earlier
on. So the memcpy() won't accidentally read from an invalid location.

Fix the warning by reducing the size of the uid variable to what's
actually needed, and thus reducing the amount of copied data.

Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Julian Wiedmann authored and David S. Miller committed Oct 3, 2020
1 parent 8e1b388 commit 398999b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/iucv/af_iucv.c
Original file line number Diff line number Diff line change
Expand Up @@ -588,11 +588,11 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
int addr_len)
{
struct sockaddr_iucv *sa = (struct sockaddr_iucv *) addr;
char uid[sizeof(sa->siucv_user_id)];
struct sock *sk = sock->sk;
struct iucv_sock *iucv;
int err = 0;
struct net_device *dev;
char uid[9];

/* Verify the input sockaddr */
if (addr_len < sizeof(struct sockaddr_iucv) ||
Expand Down

0 comments on commit 398999b

Please sign in to comment.