[PATCH net] net: vlan: fix vlan name truncation

[PATCH net] net: vlan: fix vlan name truncation

[Janis Edvarts Lacis]

register_vlan_device() from net/8021q/vlan.c sets name based on a field
name_type from struct vlan_net. If name_type is VLAN_NAME_TYPE_RAW_PLUS_VID
or VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD, register_vlan_device() sets vlan
device's name to the actual net_device's name and adds vid at the end of
this name separated by a dot.

Network interface's name is limited to at most 16 characters, including NUL.
Therefore, if the real_dev->name is long enough, then adding the vid
at the end of this name can lead to the result exceeding 16 bytes which
leads to a truncated name for the vlan device created in register_vlan_device().

This patch fixes the issue by returning -ENAMETOOLONG from
register_vlan_device() if the newly created name does not fit in 16
bytes.

The bug was discovered when compiling with flag W=1, the following warning comes up:
linux/net/8021q/vlan.c: In function ‘vlan_ioctl_handler’:
linux/net/8021q/vlan.c:250:46: error: ‘%i’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 0 and 15 [-Werror=format-truncation=]
  250 |                 snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
      |                                              ^~
In function ‘register_vlan_device’,
    inlined from ‘vlan_ioctl_handler’ at linux/net/8021q/vlan.c:588:9:
linux/net/8021q/vlan.c:250:42: note: directive argument in the range [0, 65535]
  250 |                 snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
      |                                          ^~~~~~~

Build & run the reproducer:
    gcc poc.c -o poc
    chmod +x poc.sh
    ./poc.sh

======BEGIN poc.sh======
#!/usr/bin/env bash

sudo ip link add vlan1234567890 type dummy
sudo ./poc

# name will not match the expected printed from poc.c on the unpatched
# kernel, there will be no vlan interface at all on the patched one
ip a
======END poc.sh========

======BEGIN poc.c======
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/if.h>
#include <linux/if_vlan.h>
#include <linux/sockios.h>

#define IF_NAME "vlan1234567890"

int main()
{
    struct vlan_ioctl_args args = {
	.cmd = ADD_VLAN_CMD,
	.u.VID = 1234,
    };

    strcpy(args.device1, IF_NAME);

    int fd = socket(AF_INET, SOCK_STREAM, 0);
    if (fd < 0) {
	perror("socket");
	return 1;
    }

    /* fails with -ENAMETOOLONG */
    if (ioctl(fd, SIOCSIFVLAN, &args) < 0) {
	perror("SIOCSIFVLAN");
	close(fd);
	return 1;
    }

    printf("Expected name: %s.%i\n", IF_NAME, args.u.VID);
    close(fd);
    return 0;
}
======END poc.c========

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Janis Edvarts Lacis <janislacis06@gmail.com>
---
 net/8021q/vlan.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 2d2efb877975..b51092d217de 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -220,7 +220,7 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
 	struct net *net = dev_net(real_dev);
 	struct vlan_net *vn = net_generic(net, vlan_net_id);
 	char name[IFNAMSIZ];
-	int err;
+	int err, len;
 
 	if (vlan_id >= VLAN_VID_MASK)
 		return -ERANGE;
@@ -234,7 +234,9 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
 	switch (vn->name_type) {
 	case VLAN_NAME_TYPE_RAW_PLUS_VID:
 		/* name will look like:	 eth1.0005 */
-		snprintf(name, IFNAMSIZ, "%s.%.4i", real_dev->name, vlan_id);
+		len = snprintf(name, IFNAMSIZ, "%s.%.4i", real_dev->name, vlan_id);
+		if (len >= sizeof(name))
+			err = -ENAMETOOLONG;
 		break;
 	case VLAN_NAME_TYPE_PLUS_VID_NO_PAD:
 		/* Put our vlan.VID in the name.
@@ -246,7 +248,9 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
 		/* Put our vlan.VID in the name.
 		 * Name will look like:	 eth0.5
 		 */
-		snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
+		len = snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
+		if (len >= sizeof(name))
+			err = -ENAMETOOLONG;
 		break;
 	case VLAN_NAME_TYPE_PLUS_VID:
 		/* Put our vlan.VID in the name.
@@ -256,6 +260,9 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
 		snprintf(name, IFNAMSIZ, "vlan%.4i", vlan_id);
 	}
 
+	if (err)
+		return err;
+
 	new_dev = alloc_netdev(sizeof(struct vlan_dev_priv), name,
 			       NET_NAME_UNKNOWN, vlan_setup);
 
-- 
2.43.0

Re: [PATCH net] net: vlan: fix vlan name truncation

[Hangbin Liu]

On Sat, Sep 05, 2026 at 12:00:24AM +0300, Janis Edvarts Lacis wrote:
> register_vlan_device() from net/8021q/vlan.c sets name based on a field
> name_type from struct vlan_net. If name_type is VLAN_NAME_TYPE_RAW_PLUS_VID
> or VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD, register_vlan_device() sets vlan
> device's name to the actual net_device's name and adds vid at the end of
> this name separated by a dot.
> 
> Network interface's name is limited to at most 16 characters, including NUL.
> Therefore, if the real_dev->name is long enough, then adding the vid
> at the end of this name can lead to the result exceeding 16 bytes which
> leads to a truncated name for the vlan device created in register_vlan_device().
> 
> This patch fixes the issue by returning -ENAMETOOLONG from
> register_vlan_device() if the newly created name does not fit in 16
> bytes.
> 
> The bug was discovered when compiling with flag W=1, the following warning comes up:
> linux/net/8021q/vlan.c: In function ‘vlan_ioctl_handler’:
> linux/net/8021q/vlan.c:250:46: error: ‘%i’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 0 and 15 [-Werror=format-truncation=]
>   250 |                 snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
>       |                                              ^~
> In function ‘register_vlan_device’,
>     inlined from ‘vlan_ioctl_handler’ at linux/net/8021q/vlan.c:588:9:
> linux/net/8021q/vlan.c:250:42: note: directive argument in the range [0, 65535]
>   250 |                 snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
>       |                                          ^~~~~~~
> 
> Build & run the reproducer:
>     gcc poc.c -o poc
>     chmod +x poc.sh
>     ./poc.sh
> 
> ======BEGIN poc.sh======
> #!/usr/bin/env bash
> 
> sudo ip link add vlan1234567890 type dummy
> sudo ./poc
> 
> # name will not match the expected printed from poc.c on the unpatched
> # kernel, there will be no vlan interface at all on the patched one
> ip a
> ======END poc.sh========
> 
> ======BEGIN poc.c======
> #include <stdio.h>
> #include <string.h>
> #include <unistd.h>
> #include <sys/ioctl.h>
> #include <linux/if.h>
> #include <linux/if_vlan.h>
> #include <linux/sockios.h>
> 
> #define IF_NAME "vlan1234567890"
> 
> int main()
> {
>     struct vlan_ioctl_args args = {
> 	.cmd = ADD_VLAN_CMD,
> 	.u.VID = 1234,
>     };
> 
>     strcpy(args.device1, IF_NAME);
> 
>     int fd = socket(AF_INET, SOCK_STREAM, 0);
>     if (fd < 0) {
> 	perror("socket");
> 	return 1;
>     }
> 
>     /* fails with -ENAMETOOLONG */
>     if (ioctl(fd, SIOCSIFVLAN, &args) < 0) {
> 	perror("SIOCSIFVLAN");
> 	close(fd);
> 	return 1;
>     }
> 
>     printf("Expected name: %s.%i\n", IF_NAME, args.u.VID);
>     close(fd);
>     return 0;
> }
> ======END poc.c========
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Janis Edvarts Lacis <janislacis06@gmail.com>
> ---
>  net/8021q/vlan.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
> index 2d2efb877975..b51092d217de 100644
> --- a/net/8021q/vlan.c
> +++ b/net/8021q/vlan.c
> @@ -220,7 +220,7 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
>  	struct net *net = dev_net(real_dev);
>  	struct vlan_net *vn = net_generic(net, vlan_net_id);
>  	char name[IFNAMSIZ];
> -	int err;
> +	int err, len;
>  
>  	if (vlan_id >= VLAN_VID_MASK)
>  		return -ERANGE;
> @@ -234,7 +234,9 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
>  	switch (vn->name_type) {
>  	case VLAN_NAME_TYPE_RAW_PLUS_VID:
>  		/* name will look like:	 eth1.0005 */
> -		snprintf(name, IFNAMSIZ, "%s.%.4i", real_dev->name, vlan_id);
> +		len = snprintf(name, IFNAMSIZ, "%s.%.4i", real_dev->name, vlan_id);
> +		if (len >= sizeof(name))
> +			err = -ENAMETOOLONG;
>  		break;
>  	case VLAN_NAME_TYPE_PLUS_VID_NO_PAD:
>  		/* Put our vlan.VID in the name.
> @@ -246,7 +248,9 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
>  		/* Put our vlan.VID in the name.
>  		 * Name will look like:	 eth0.5
>  		 */
> -		snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
> +		len = snprintf(name, IFNAMSIZ, "%s.%i", real_dev->name, vlan_id);
> +		if (len >= sizeof(name))
> +			err = -ENAMETOOLONG;
>  		break;
>  	case VLAN_NAME_TYPE_PLUS_VID:
>  		/* Put our vlan.VID in the name.
> @@ -256,6 +260,9 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
>  		snprintf(name, IFNAMSIZ, "vlan%.4i", vlan_id);
>  	}
>  
> +	if (err)
> +		return err;
> +
>  	new_dev = alloc_netdev(sizeof(struct vlan_dev_priv), name,
>  			       NET_NAME_UNKNOWN, vlan_setup);
>  
> -- 
> 2.43.0
> 

Nice catch!

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net] net: vlan: fix vlan name truncation

[Paolo Abeni]

On 9/4/26 11:00 PM, Janis Edvarts Lacis wrote:
> register_vlan_device() from net/8021q/vlan.c sets name based on a field
> name_type from struct vlan_net. If name_type is VLAN_NAME_TYPE_RAW_PLUS_VID
> or VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD, register_vlan_device() sets vlan
> device's name to the actual net_device's name and adds vid at the end of
> this name separated by a dot.
> 
> Network interface's name is limited to at most 16 characters, including NUL.
> Therefore, if the real_dev->name is long enough, then adding the vid
> at the end of this name can lead to the result exceeding 16 bytes which
> leads to a truncated name for the vlan device created in register_vlan_device().
> 
> This patch fixes the issue by returning -ENAMETOOLONG from
> register_vlan_device() if the newly created name does not fit in 16
> bytes.

I'm sorry, but I don't think we can accept this patch: this change an
user-space visible behavior: even if a strange one, existing applications
and/or setups may relay on it and they will be broken by this change.

/P

Re: [PATCH net] net: vlan: fix vlan name truncation

[Janis Edvarts Lacis]

On Thu, Sep 10, 2026 at 10:56 AM, Paolo Abeni wrote:
> I'm sorry, but I don't think we can accept this patch: this change an
> user-space visible behavior: ...

Okay, I see the issue. How about a 'solution' like this: we use scnprintf() 
instead of snprintf() in two branches that can have the name truncated? From 
what I see, the only difference between snprintf() and scnprintf() is the 
return value so there should be no functional change visible to the user. I 
tested the W=1 build, the warning is gone if scnprintf() is used.

Re: [PATCH net] net: vlan: fix vlan name truncation

[David Laight]

On Fri, 11 Sep 2026 19:35:43 +0300
Janis Edvarts Lacis <janislacis06@gmail.com> wrote:

> On Thu, Sep 10, 2026 at 10:56 AM, Paolo Abeni wrote:
> > I'm sorry, but I don't think we can accept this patch: this change an
> > user-space visible behavior: ...  
> 
> Okay, I see the issue. How about a 'solution' like this: we use scnprintf() 
> instead of snprintf() in two branches that can have the name truncated? From 
> what I see, the only difference between snprintf() and scnprintf() is the 
> return value so there should be no functional change visible to the user. I 
> tested the W=1 build, the warning is gone if scnprintf() is used.

I think that ought to be considered a bug in the compiler options.
There is no real justification for snprintf() and scnprintf() being different
(especially if the result is ignored).

David