Skip to contentSkip to conversation

ip_tunnel: Fix name string concatenate in __ip_tunnel_create()

PATCH Applied Sultan Alsawaf 2 participants 2 messages Jun 6, 2018 – Jun 7, 2018

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 ip_tunnel: Fix name string concatenate in __ip_tunnel_create()

By passing a limit of 2 bytes to strncat, strncat is limited to writing fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string bounds checks entirely since they're unneeded.

---
 net/ipv4/ip_tunnel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/ip_tunnel.c +2 -2
index 38d906baf1df..c4f5602308ed 100644
@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
 	} else {
 		if (strlen(ops->kind) > (IFNAMSIZ - 3))
 			goto failed;
-		strlcpy(name, ops->kind, IFNAMSIZ);
-		strncat(name, "%d", 2);
+		strcpy(name, ops->kind);
+		strcat(name, "%d");
 	}
 
 	ASSERT_RTNL();
Signature · 1 line
2.17.1
maintainer Applied
#1 lore raw

From: Sultan Alsawaf <[email protected]>
Date: Wed, 6 Jun 2018 15:56:54 -0700

Quoted 7 lines

By passing a limit of 2 bytes to strncat, strncat is limited to writing fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string bounds checks entirely since they're unneeded.

Applied.