Please apply the following patch for smc to netdev's net tree. Both patches fix possible out-of-bounds reads. The original code expected that snprintf() reads len-1 bytes from source and appends the terminating null, but actually snprintf() first copies len bytes and finally overwrites the last byte with a null. Fix this by using memcpy() and terminating the string afterwards. Guvenc Gulce (1): net/smc: use memcpy instead of snprintf to avoid out of bounds read Jakub Kicinski (1): smc: fix out of bound access in smc_nl_get_sys_info() net/smc/smc_core.c | 20 +++++++++++++------- net/smc/smc_ib.c | 6 +++--- net/smc/smc_ism.c | 3 ++- 3 files changed, 18 insertions(+), 11 deletions(-) -- 2.17.1
