summaryrefslogtreecommitdiffstats
path: root/net/core
diff options
context:
space:
mode:
authorRasmus Villemoes <linux@rasmusvillemoes.dk>2017-11-13 00:15:04 +0100
committerDavid S. Miller <davem@davemloft.net>2017-11-14 16:38:45 +0900
commit51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa (patch)
treec4caf118661ec22af9844f6cd26ee80cbcdfca26 /net/core
parent951b7966959fde507e1718627b37795f40b704f4 (diff)
downloadlinux-stable-51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa.tar.gz
linux-stable-51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa.tar.bz2
linux-stable-51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa.zip
net: core: improve sanity checking in __dev_alloc_name
__dev_alloc_name is called from the public (and exported) dev_alloc_name(), so we don't have a guarantee that strlen(name) is at most IFNAMSIZ. If somebody manages to get __dev_alloc_name called with a % char beyond the 31st character, we'd be making a snprintf() call that will very easily crash the kernel (using an appropriate %p extension, we'll likely dereference some completely bogus pointer). In the normal case where strlen() is sane, we don't even save anything by limiting to IFNAMSIZ, so just use strchr(). Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/dev.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/dev.c b/net/core/dev.c
index 658337bf33e4..1a5d31fdea27 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1064,7 +1064,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
unsigned long *inuse;
struct net_device *d;
- p = strnchr(name, IFNAMSIZ-1, '%');
+ p = strchr(name, '%');
if (p) {
/*
* Verify the string as this thing may have come from