From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751642AbdKLXRY (ORCPT ); Sun, 12 Nov 2017 18:17:24 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:39522 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751073AbdKLXPY (ORCPT ); Sun, 12 Nov 2017 18:15:24 -0500 X-Google-Smtp-Source: AGs4zMb/5SCJlWWjmchAv8uJu9RY1q5fjiy6HLqcY7hCjShfSIVf21njfASQJyjvS644Ycj/jAbcDQ== From: Rasmus Villemoes To: "David S. Miller" Cc: Rasmus Villemoes , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/7] net: core: improve sanity checking in __dev_alloc_name Date: Mon, 13 Nov 2017 00:15:04 +0100 Message-Id: <20171112231511.4666-2-linux@rasmusvillemoes.dk> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171112231511.4666-1-linux@rasmusvillemoes.dk> References: <20171112231511.4666-1-linux@rasmusvillemoes.dk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org __dev_alloc_name is called from the public (and exported) dev_alloc_name(), so we don't have a guarantee that strlen(name) is at most IFNAMSIZ. If somebody manages to get __dev_alloc_name called with a % char beyond the 31st character, we'd be making a snprintf() call that will very easily crash the kernel (using an appropriate %p extension, we'll likely dereference some completely bogus pointer). In the normal case where strlen() is sane, we don't even save anything by limiting to IFNAMSIZ, so just use strchr(). Signed-off-by: Rasmus Villemoes --- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index 11596a302a26..87e19804757b 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1062,7 +1062,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf) unsigned long *inuse; struct net_device *d; - p = strnchr(name, IFNAMSIZ-1, '%'); + p = strchr(name, '%'); if (p) { /* * Verify the string as this thing may have come from -- 2.11.0