]> asedeno.scripts.mit.edu Git - linux.git/commit
RDMA/iwcm: Fix string truncation error
authorLeon Romanovsky <leonro@mellanox.com>
Tue, 19 Feb 2019 11:09:57 +0000 (13:09 +0200)
committerJason Gunthorpe <jgg@mellanox.com>
Wed, 20 Feb 2019 03:52:19 +0000 (20:52 -0700)
commit1882ab867863531ab9caab81fd6ac5fee6d1a314
tree0ccc875b1bf6ee1a77fd255ceea5b72cd41a774a
parente278173fd19eb537e73190c50c162950f192e047
RDMA/iwcm: Fix string truncation error

The strlen() check at the beginning of iw_cm_map() ensures that devname
and ifname strings are less than destinations to which they are supposed
to be copied. Change strncpy() call to be strcpy(), because we are
protected from overflow. Zero the entire string buffer to avoid copying
uninitialized kernel stack memory to userspace.

This fixes the compilation warning below:

In file included from ./include/linux/dma-mapping.h:6,
                 from drivers/infiniband/core/iwcm.c:38:
In function _strncpy_,
    inlined from _iw_cm_map_ at drivers/infiniband/core/iwcm.c:519:2:
./include/linux/string.h:253:9: warning: ___builtin_strncpy_ specified
bound 32 equals destination size [-Wstringop-truncation]
  return __builtin_strncpy(p, q, size);
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes: d53ec8af56d5 ("RDMA/iwcm: Don't copy past the end of dev_name() string")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/iwcm.c