Skip to contentSkip to conversation

netdevice: Fix wrong string handle in kernel command line parsing

PATCH In review Wang Chen 3 participants 4 messages Jun 30, 2008 – Jul 2, 2008

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Wang Chen

author
#0 lore raw

PATCH 1/1 netdevice: Fix wrong string handle in kernel command line parsing

1. In netdev_boot_setup_add(), a long name will leak.
ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname.........
2. In netdev_boot_setup_check(), mismatch will happen if s[i].name is a substring of dev->name.
ex. : dev=...eth1 dev=...eth11

Signed-off-by Wang Chen <[email protected]>

---

net/core/dev.c +2 -2
index c421a1f..9ecb3db 100644
@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
 	for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
 		if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
 			memset(s[i].name, 0, sizeof(s[i].name));
-			strcpy(s[i].name, name);
+			strncpy(s[i].name, name, IFNAMSIZ);
 			memcpy(&s[i].map, map, sizeof(s[i].map));
 			break;
 		}

@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)
 
 	for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
 		if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
-		    !strncmp(dev->name, s[i].name, strlen(s[i].name))) {
+		    !strcmp(dev->name, s[i].name)) {
 			dev->irq 	= s[i].map.irq;
 			dev->base_addr 	= s[i].map.base_addr;
 			dev->mem_start 	= s[i].map.mem_start;
#1 lore raw
Quoted 5 lines · Wang Chen

1. In netdev_boot_setup_add(), a long name will leak.
ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname.........
2. In netdev_boot_setup_check(), mismatch will happen if s[i].name is a substring of dev->name.
ex. : dev=...eth1 dev=...eth11

Well spotted, but...

net/core/dev.c static int netdev_boot_setup_add(char *name, struct ifmap *map) · line 457

Quoted 12 lines
Signed-off-by Wang Chen <[email protected]>

---

net/core/dev.c +1 -1
index c421a1f..9ecb3db 100644
@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
 	for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
 		if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
 			memset(s[i].name, 0, sizeof(s[i].name));
-			strcpy(s[i].name, name);
+			strncpy(s[i].name, name, IFNAMSIZ);

I think that strncpy() should be strlcpy(), because strncpy() does not ensure null-termination.

Ben.

Signature · 2 lines
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
author
#2 lore raw

V2 [PATCH] netdevice: Fix wrong string handle in kernel command line parsing

Ben Hutchings said the following on 2008-6-30 18:25:

Quoted 6 lines

Review

Quoted 2 lines
(quoted diff) +1 -1
-			strcpy(s[i].name, name);
+			strncpy(s[i].name, name, IFNAMSIZ);

I think that strncpy() should be strlcpy(), because strncpy() does not ensure null-termination.

Of course. Thanks, Ben.

v1->v2: Use strlcpy() to ensure s[i].name be null-termination.

1. In netdev_boot_setup_add(), a long name will leak.
ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname.........
2. In netdev_boot_setup_check(), mismatch will happen if s[i].name is a substring of dev->name.
ex. : dev=...eth1 dev=...eth11

Signed-off-by Wang Chen <[email protected]>

---

net/core/dev.c +2 -2
index c421a1f..3360df6 100644
@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
 	for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
 		if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
 			memset(s[i].name, 0, sizeof(s[i].name));
-			strcpy(s[i].name, name);
+			strlcpy(s[i].name, name, IFNAMSIZ);
 			memcpy(&s[i].map, map, sizeof(s[i].map));
 			break;
 		}

@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)
 
 	for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
 		if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
-		    !strncmp(dev->name, s[i].name, strlen(s[i].name))) {
+		    !strcmp(dev->name, s[i].name)) {
 			dev->irq 	= s[i].map.irq;
 			dev->base_addr 	= s[i].map.base_addr;
 			dev->mem_start 	= s[i].map.mem_start;
maintainer
#3 lore raw

Re: V2 [PATCH] netdevice: Fix wrong string handle in kernel command line parsing

From: Wang Chen <[email protected]>
Date: Tue, 01 Jul 2008 08:56:40 +0800

Quoted 12 lines

Ben Hutchings said the following on 2008-6-30 18:25:

Quoted 6 lines

Review

Quoted 2 lines
(quoted diff) +1 -1
-			strcpy(s[i].name, name);
+			strncpy(s[i].name, name, IFNAMSIZ);

I think that strncpy() should be strlcpy(), because strncpy() does not ensure null-termination.

Of course. Thanks, Ben.

v1->v2: Use strlcpy() to ensure s[i].name be null-termination.

Quoted 7 lines

1. In netdev_boot_setup_add(), a long name will leak.
ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname.........
2. In netdev_boot_setup_check(), mismatch will happen if s[i].name is a substring of dev->name.
ex. : dev=...eth1 dev=...eth11

Signed-off-by Wang Chen <[email protected]>

Looks good, applied, thanks everyone.