tipc: Dont send random pad bytes in RESET/ACTIVATE messages

Subject: [PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages

The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer. Replace the strcpy(data, l->if_name) with memcpy() so that the pad bytes are actually written (l->if_name[] is zero padded) rather than sending random bytes from the skb to the remote system.

Replace two other strcpy() with strscpy().

Fixes e74a386d70c7 ("tipc: remove pre-allocated message header in link

struct")

Signed-off-by David Laight <[email protected]>

---
net/tipc/link.c | 6 +++---

1 file changed, 3 insertions(+), 3 deletions(-)

net/tipc/link.c index 49dfc098d89b..6427c69f8929 renamed from net/tipc/link.c +0 -0

100644

net/tipc/link.c +1 -1

@@ -504,7 +504,7 @@ bool tipc_link_create(struct net *net, char *if_name,
 int bearer_id,
 	snprintf(l->name, sizeof(l->name), "%s:%s-%s:unknown",
 		 self_str, if_name, peer_str);
 
-	strcpy(l->if_name, if_name);
+	strscpy(l->if_name, if_name);
 	l->addr = peer;
 	l->peer_caps = peer_caps;

	l->net = net;

net/tipc/link.c +1 -1

@@ -574,7 +574,7 @@ bool tipc_link_bc_create(struct net *net, u32
 ownnode, u32 peer, u8 *peer_id,
 		snprintf(l->name, sizeof(l->name), "%s:%s", tipc_bclink_name,
 			 peer_str);
 	} else {
-		strcpy(l->name, tipc_bclink_name);
+		strscpy(l->name, tipc_bclink_name);
 	}
 	trace_tipc_link_reset(l, TIPC_DUMP_ALL, "bclink created!");

	tipc_link_reset(l);

net/tipc/link.c +1 -1

@@ -1898,7 +1898,7 @@ static void tipc_link_build_proto_msg(struct tipc_link
 *l, int mtyp, bool probe,
 			msg_set_dest_session(hdr, l->peer_session);
 		}
 		msg_set_max_pkt(hdr, l->advertised_mtu);
-		strcpy(data, l->if_name);
+		memcpy(data, l->if_name, TIPC_MAX_IF_NAME);
 		msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
 		skb_trim(skb, INT_H_SIZE + TIPC_MAX_IF_NAME);

	}

--
2.39.5