diff options
| author | Gal Pressman <gal@nvidia.com> | 2023-11-14 09:56:18 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-11-15 11:05:08 +0000 |
| commit | 674e318089468ece99aef4796eaef7add57f36b2 (patch) | |
| tree | f6486b70fb01391bd9993a8b0e5e15c375deb621 /net/core/dev.c | |
| parent | efc0c8363bc6dab2cd540acc886e6097deee8bb9 (diff) | |
| download | linux-674e318089468ece99aef4796eaef7add57f36b2.tar.gz | |
net: Fix undefined behavior in netdev name allocation
Cited commit removed the strscpy() call and kept the snprintf() only.
It is common to use 'dev->name' as the format string before a netdev is
registered, this results in 'res' and 'name' pointers being equal.
According to POSIX, if copying takes place between objects that overlap
as a result of a call to sprintf() or snprintf(), the results are
undefined.
Add back the strscpy() and use 'buf' as an intermediate buffer.
Fixes: 7ad17b04dc7b ("net: trust the bitmap in __dev_alloc_name()")
Cc: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/dev.c')
| -rw-r--r-- | net/core/dev.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 0d548431f3fad..af53f6d838ce9 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1119,7 +1119,9 @@ static int __dev_alloc_name(struct net *net, const char *name, char *res) if (i == max_netdevices) return -ENFILE; - snprintf(res, IFNAMSIZ, name, i); + /* 'res' and 'name' could overlap, use 'buf' as an intermediate buffer */ + strscpy(buf, name, IFNAMSIZ); + snprintf(res, IFNAMSIZ, buf, i); return i; } |