RE: [PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages

Subject: [PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE
messages

The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.
Replace the strcpy(data, l->if_name) with memcpy() so that the pad bytes are
actually written (l->if_name[] is zero padded) rather than sending random
bytes from the skb to the remote system.

Replace two other strcpy() with strscpy().

Fixes: e74a386d70c7 ("tipc: remove pre-allocated message header in link
struct")
Signed-off-by: David Laight <redacted>
---
net/tipc/link.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c index 49dfc098d89b..6427c69f8929

100644

--- a/net/tipc/link.c
+++ b/net/tipc/link.c

@@ -504,7 +504,7 @@ bool tipc_link_create(struct net *net, char *if_name,

int bearer_id,
	snprintf(l->name, sizeof(l->name), "%s:%s-%s:unknown",
		 self_str, if_name, peer_str);

-	strcpy(l->if_name, if_name);
+	strscpy(l->if_name, if_name);
	l->addr = peer;
	l->peer_caps = peer_caps;
	l->net = net;

@@ -574,7 +574,7 @@ bool tipc_link_bc_create(struct net *net, u32

ownnode, u32 peer, u8 *peer_id,
		snprintf(l->name, sizeof(l->name), "%s:%s", tipc_bclink_name,
			 peer_str);
	} else {
-		strcpy(l->name, tipc_bclink_name);
+		strscpy(l->name, tipc_bclink_name);
	}
	trace_tipc_link_reset(l, TIPC_DUMP_ALL, "bclink created!");
	tipc_link_reset(l);

@@ -1898,7 +1898,7 @@ static void tipc_link_build_proto_msg(struct tipc_link

*l, int mtyp, bool probe,
			msg_set_dest_session(hdr, l->peer_session);
		}
		msg_set_max_pkt(hdr, l->advertised_mtu);
-		strcpy(data, l->if_name);
+		memcpy(data, l->if_name, TIPC_MAX_IF_NAME);
		msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
		skb_trim(skb, INT_H_SIZE + TIPC_MAX_IF_NAME);
	}
--
2.39.5