From 5075b961a29ff9c418e1fefe78432e95dd0a5fcc Mon Sep 17 00:00:00 2001

From: Michal Schmidt <mschmidt@redhat.com>

Date: Wed, 1 Feb 2023 22:41:06 +0100

Subject: [PATCH 1/3] util: fix overflow in remap_node_name()

The function remap_node_name() assumes the parameter 'nodedesc' is at

least IB_SMP_DATA_SIZE + 1 (i.e. 65) bytes long, because it passes it to

clean_nodedesc() that writes a nul-terminator to it at offset

IB_SMP_DATA_SIZE. Callers in infiniband-diags/saquery.c pass

a (struct ib_node_desc_t).description as the argument, which is only

IB_NODE_DESCRIPTION_SIZE (i.e. 64) bytes long. This is an overflow.

An odd thing about remap_node_name() is that it may (but does not

always) rewrite the nodedesc in-place. Callers do not appear to

appreciate this behavior. Most of them are various print_* and dump_*

functions where rewriting the input makes no sense. Some callers make a

local copy of the nodedesc first, possibly to protect the original.

One caller (infiniband-diags/saquery.c:print_node_records()) checks if

either the original description or the remapped one matches a given

requested_name - so it looks like it prefers the original to be

not rewritten.

Let's make remap_node_name() a bit safer and more convenient to use.

Allocate a fixed-sized copy first. Then use strncpy to copy from

'nodedesc', never reading more than IB_SMP_DATA_SIZE (64) bytes.

Apply clean_nodedesc() on the correctly-sized copy. This solves the

overflow bug. Also, the in-place rewrite of 'nodedesc' is gone and it

can become a (const char*).

The overflow was found by a static checker (covscan).

Fixes: d974c4e398d2 ("Fix max length of node description (ibnetdiscover and smpquery)")

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

---

 util/node_name_map.c | 12 +++++++++---

 util/node_name_map.h |  3 +--

 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/util/node_name_map.c b/util/node_name_map.c

index 30b73eb1448e..511cb92ef19c 100644

--- a/util/node_name_map.c

+++ b/util/node_name_map.c

@@ -95,7 +95,7 @@ void close_node_name_map(nn_map_t * map)

 	free(map);

 }

-char *remap_node_name(nn_map_t * map, uint64_t target_guid, char *nodedesc)

+char *remap_node_name(nn_map_t * map, uint64_t target_guid, const char *nodedesc)

 {

 	char *rc = NULL;

 	name_map_item_t *item = NULL;

@@ -108,8 +108,14 @@ char *remap_node_name(nn_map_t * map, uint64_t target_guid, char *nodedesc)

 		rc = strdup(item->name);

 done:

-	if (rc == NULL)

-		rc = strdup(clean_nodedesc(nodedesc));

+	if (rc == NULL) {

+		rc = malloc(IB_SMP_DATA_SIZE + 1);

+		if (rc) {

+			strncpy(rc, nodedesc, IB_SMP_DATA_SIZE);

+			rc[IB_SMP_DATA_SIZE] = '\0';

+			clean_nodedesc(rc);

+		}

+	}

 	return (rc);

 }

diff --git a/util/node_name_map.h b/util/node_name_map.h

index e78d274b116e..d83d672782c4 100644

--- a/util/node_name_map.h

+++ b/util/node_name_map.h

@@ -12,8 +12,7 @@ typedef struct nn_map nn_map_t;

 nn_map_t *open_node_name_map(const char *node_name_map);

 void close_node_name_map(nn_map_t *map);

-/* NOTE: parameter "nodedesc" may be modified here. */

-char *remap_node_name(nn_map_t *map, uint64_t target_guid, char *nodedesc);

+char *remap_node_name(nn_map_t *map, uint64_t target_guid, const char *nodedesc);

 char *clean_nodedesc(char *nodedesc);

 #endif

-- 

2.39.1