Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d7bb74c3 authored by Erik Hugne's avatar Erik Hugne Committed by David S. Miller
Browse files

tipc: fix out of bounds indexing 



Commit 78acb1f9 ("tipc: add
ioctl to fetch link names") introduced a buffer overflow bug where
specially crafted ioctl requests could cause out-of-bounds indexing
of the node->links array. This was caused by an incorrect check vs
MAX_BEARERS, and the static code checker complaint is:
net/tipc/node.c:459 tipc_node_get_linkname() error: buffer overflow 'node->links' 2 <= 2

Signed-off-by: default avatarErik Hugne <erik.hugne@ericsson.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d37556eb

net/tipc/node.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -453,7 +453,7 @@ int tipc_node_get_linkname(u32 bearer_id, u32 addr, char *linkname, size_t len) 
	struct tipc_link *link;

	struct tipc_link *link;

	struct tipc_node *node = tipc_node_find(addr);

	struct tipc_node *node = tipc_node_find(addr);





	if ((bearer_id > MAX_BEARERS) || !node)

	if ((bearer_id >= MAX_BEARERS) || !node)

		return -EINVAL;

		return -EINVAL;

	tipc_node_lock(node);

	tipc_node_lock(node);

	link = node->links[bearer_id];

	link = node->links[bearer_id];