Skip to content

Commit

Permalink
tipc: fix nl compat regression for link statistics
Browse files Browse the repository at this point in the history
[ Upstream commit 55e77a3 ]

Fix incorrect use of nla_strlcpy() where the first NLA_HDRLEN bytes
of the link name where left out.

Making the output of tipc-config -ls look something like:
Link statistics:
dcast-link
1:data0-1.1.2:data0
1:data0-1.1.3:data0

Also, for the record, the patch that introduce this regression
claims "Sending the whole object out can cause a leak". Which isn't
very likely as this is a compat layer, where the data we are parsing
is generated by us and we know the string to be NULL terminated. But
you can of course never be to secure.

Fixes: 5d2be14 (tipc: fix an infoleak in tipc_nl_compat_link_dump)
Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Richard Alpe authored and Greg Kroah-Hartman committed Sep 15, 2016
1 parent 5fb7161 commit 8b2e345
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/tipc/netlink_compat.c
Original file line number Diff line number Diff line change
Expand Up @@ -574,7 +574,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,

link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]),
nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME],
TIPC_MAX_LINK_NAME);

return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
Expand Down

0 comments on commit 8b2e345

Please sign in to comment.