[PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages

[PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages

[David Laight]

The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.
Replace the strcpy(data, l->if_name) with memcpy() so that the
pad bytes are actually written (l->if_name[] is zero padded)
rather than sending random bytes from the skb to the remote system.

Replace two other strcpy() with strscpy().

Fixes: e74a386d70c7 ("tipc: remove pre-allocated message header in link struct")
Signed-off-by: David Laight <david.laight.linux@gmail.com>
---
 net/tipc/link.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 49dfc098d89b..6427c69f8929 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -504,7 +504,7 @@ bool tipc_link_create(struct net *net, char *if_name, int bearer_id,
 	snprintf(l->name, sizeof(l->name), "%s:%s-%s:unknown",
 		 self_str, if_name, peer_str);
 
-	strcpy(l->if_name, if_name);
+	strscpy(l->if_name, if_name);
 	l->addr = peer;
 	l->peer_caps = peer_caps;
 	l->net = net;
@@ -574,7 +574,7 @@ bool tipc_link_bc_create(struct net *net, u32 ownnode, u32 peer, u8 *peer_id,
 		snprintf(l->name, sizeof(l->name), "%s:%s", tipc_bclink_name,
 			 peer_str);
 	} else {
-		strcpy(l->name, tipc_bclink_name);
+		strscpy(l->name, tipc_bclink_name);
 	}
 	trace_tipc_link_reset(l, TIPC_DUMP_ALL, "bclink created!");
 	tipc_link_reset(l);
@@ -1898,7 +1898,7 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
 			msg_set_dest_session(hdr, l->peer_session);
 		}
 		msg_set_max_pkt(hdr, l->advertised_mtu);
-		strcpy(data, l->if_name);
+		memcpy(data, l->if_name, TIPC_MAX_IF_NAME);
 		msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
 		skb_trim(skb, INT_H_SIZE + TIPC_MAX_IF_NAME);
 	}
-- 
2.39.5

RE: [PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages

[Tung Quang Nguyen]

>Subject: [PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE
>messages
>
>The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.
>Replace the strcpy(data, l->if_name) with memcpy() so that the pad bytes are
>actually written (l->if_name[] is zero padded) rather than sending random
>bytes from the skb to the remote system.
>
>Replace two other strcpy() with strscpy().
>
>Fixes: e74a386d70c7 ("tipc: remove pre-allocated message header in link
>struct")
>Signed-off-by: David Laight <david.laight.linux@gmail.com>
>---
> net/tipc/link.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/net/tipc/link.c b/net/tipc/link.c index 49dfc098d89b..6427c69f8929
>100644
>--- a/net/tipc/link.c
>+++ b/net/tipc/link.c
>@@ -504,7 +504,7 @@ bool tipc_link_create(struct net *net, char *if_name,
>int bearer_id,
> 	snprintf(l->name, sizeof(l->name), "%s:%s-%s:unknown",
> 		 self_str, if_name, peer_str);
>
>-	strcpy(l->if_name, if_name);
>+	strscpy(l->if_name, if_name);
> 	l->addr = peer;
> 	l->peer_caps = peer_caps;
> 	l->net = net;
>@@ -574,7 +574,7 @@ bool tipc_link_bc_create(struct net *net, u32
>ownnode, u32 peer, u8 *peer_id,
> 		snprintf(l->name, sizeof(l->name), "%s:%s", tipc_bclink_name,
> 			 peer_str);
> 	} else {
>-		strcpy(l->name, tipc_bclink_name);
>+		strscpy(l->name, tipc_bclink_name);
> 	}
> 	trace_tipc_link_reset(l, TIPC_DUMP_ALL, "bclink created!");
> 	tipc_link_reset(l);
>@@ -1898,7 +1898,7 @@ static void tipc_link_build_proto_msg(struct tipc_link
>*l, int mtyp, bool probe,
> 			msg_set_dest_session(hdr, l->peer_session);
> 		}
> 		msg_set_max_pkt(hdr, l->advertised_mtu);
>-		strcpy(data, l->if_name);
>+		memcpy(data, l->if_name, TIPC_MAX_IF_NAME);
> 		msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
> 		skb_trim(skb, INT_H_SIZE + TIPC_MAX_IF_NAME);
> 	}
>--
>2.39.5
>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>

Re: [PATCH net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sat, 29 Aug 2026 12:58:12 +0100 you wrote:
> The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.
> Replace the strcpy(data, l->if_name) with memcpy() so that the
> pad bytes are actually written (l->if_name[] is zero padded)
> rather than sending random bytes from the skb to the remote system.
> 
> Replace two other strcpy() with strscpy().
> 
> [...]

Here is the summary with links:
  - [net] tipc: Dont send random pad bytes in RESET/ACTIVATE messages
    https://git.kernel.org/netdev/net/c/81c600c26302

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html