Patch "net/smc: use memcpy instead of snprintf to avoid out of bounds read" has been added to the 5.17-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/smc: use memcpy instead of snprintf to avoid out of bounds read

to the 5.17-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-smc-use-memcpy-instead-of-snprintf-to-avoid-out-.patch
and it can be found in the queue-5.17 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6aae28b071fbd698a5bf45928856871b076d619f
Author: Karsten Graul <kgraul@xxxxxxxxxxxxx>
Date:   Fri Apr 8 17:10:33 2022 +0200

    net/smc: use memcpy instead of snprintf to avoid out of bounds read
    
    [ Upstream commit b1871fd48efc567650dbdc974e5a2342a03fe0d2 ]
    
    Using snprintf() to convert not null-terminated strings to null
    terminated strings may cause out of bounds read in the source string.
    Therefore use memcpy() and terminate the target string with a null
    afterwards.
    
    Fixes: fa0866625543 ("net/smc: add support for user defined EIDs")
    Fixes: 3c572145c24e ("net/smc: add generic netlink support for system EID")
    Signed-off-by: Karsten Graul <kgraul@xxxxxxxxxxxxx>
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index ce27399b38b1..f9f3f59c79de 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -191,7 +191,8 @@ static int smc_nl_ueid_dumpinfo(struct sk_buff *skb, u32 portid, u32 seq,
 			  flags, SMC_NETLINK_DUMP_UEID);
 	if (!hdr)
 		return -ENOMEM;
-	snprintf(ueid_str, sizeof(ueid_str), "%s", ueid);
+	memcpy(ueid_str, ueid, SMC_MAX_EID_LEN);
+	ueid_str[SMC_MAX_EID_LEN] = 0;
 	if (nla_put_string(skb, SMC_NLA_EID_TABLE_ENTRY, ueid_str)) {
 		genlmsg_cancel(skb, hdr);
 		return -EMSGSIZE;
@@ -252,7 +253,8 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb)
 		goto end;
 
 	smc_ism_get_system_eid(&seid);
-	snprintf(seid_str, sizeof(seid_str), "%s", seid);
+	memcpy(seid_str, seid, SMC_MAX_EID_LEN);
+	seid_str[SMC_MAX_EID_LEN] = 0;
 	if (nla_put_string(skb, SMC_NLA_SEID_ENTRY, seid_str))
 		goto err;
 	read_lock(&smc_clc_eid_table.lock);