From: Rasmus Villemoes Date: Sun, 12 Nov 2017 23:15:04 +0000 (+0100) Subject: net: core: improve sanity checking in __dev_alloc_name X-Git-Tag: v4.15-rc1~108^2~33^2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=51f299dd94bb1e28d03eefbc4fe0b9282f9ee2fa;p=thirdparty%2Flinux.git net: core: improve sanity checking in __dev_alloc_name __dev_alloc_name is called from the public (and exported) dev_alloc_name(), so we don't have a guarantee that strlen(name) is at most IFNAMSIZ. If somebody manages to get __dev_alloc_name called with a % char beyond the 31st character, we'd be making a snprintf() call that will very easily crash the kernel (using an appropriate %p extension, we'll likely dereference some completely bogus pointer). In the normal case where strlen() is sane, we don't even save anything by limiting to IFNAMSIZ, so just use strchr(). Signed-off-by: Rasmus Villemoes Signed-off-by: David S. Miller --- diff --git a/net/core/dev.c b/net/core/dev.c index 658337bf33e43..1a5d31fdea273 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1064,7 +1064,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf) unsigned long *inuse; struct net_device *d; - p = strnchr(name, IFNAMSIZ-1, '%'); + p = strchr(name, '%'); if (p) { /* * Verify the string as this thing may have come from