redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

net: core: improve sanity checking in __dev_alloc_name 

__dev_alloc_name is called from the public (and exported)
dev_alloc_name(), so we don't have a guarantee that strlen(name) is at
most IFNAMSIZ. If somebody manages to get __dev_alloc_name called with a
% char beyond the 31st character, we'd be making a snprintf() call that
will very easily crash the kernel (using an appropriate %p extension,
we'll likely dereference some completely bogus pointer).

In the normal case where strlen() is sane, we don't even save anything
by limiting to IFNAMSIZ, so just use strchr().

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Rasmus Villemoes 2017-11-13 00:15:04 +01:00 committed by David S. Miller
parent 951b796695
commit 51f299dd94
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/core/dev.c
View File

@ -1064,7 +1064,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
unsigned long *inuse;
struct net_device *d;
p = strnchr(name, IFNAMSIZ-1, '%');
p = strchr(name, '%');
if (p) {
/*
* Verify the string as this thing may have come from