diff options
| author | Rasmus Villemoes <linux@rasmusvillemoes.dk> | 2017-11-13 00:15:04 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-11-14 16:38:45 +0900 |
| commit | 51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa (patch) | |
| tree | c4caf118661ec22af9844f6cd26ee80cbcdfca26 /net/core | |
| parent | 951b7966959fde507e1718627b37795f40b704f4 (diff) | |
| download | lwn-51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa.tar.gz lwn-51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa.zip | |
net: core: improve sanity checking in __dev_alloc_name
__dev_alloc_name is called from the public (and exported)
dev_alloc_name(), so we don't have a guarantee that strlen(name) is at
most IFNAMSIZ. If somebody manages to get __dev_alloc_name called with a
% char beyond the 31st character, we'd be making a snprintf() call that
will very easily crash the kernel (using an appropriate %p extension,
we'll likely dereference some completely bogus pointer).
In the normal case where strlen() is sane, we don't even save anything
by limiting to IFNAMSIZ, so just use strchr().
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/dev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 658337bf33e4..1a5d31fdea27 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1064,7 +1064,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf) unsigned long *inuse; struct net_device *d; - p = strnchr(name, IFNAMSIZ-1, '%'); + p = strchr(name, '%'); if (p) { /* * Verify the string as this thing may have come from |