| From: Eric Dumazet <edumazet@google.com> |
| Date: Thu, 5 Apr 2018 06:39:30 -0700 |
| Subject: ip6_tunnel: better validate user provided tunnel names |
| |
| commit db7a65e3ab78e5b1c4b17c0870ebee35a4ee3257 upstream. |
| |
| Use valid_name() to make sure user does not provide illegal |
| device name. |
| |
| Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| [bwh: Backported to 3.16: |
| - Don't touch err as ip6_tnl_create() does not return an error code |
| - Adjust context] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| --- a/net/ipv6/ip6_tunnel.c |
| +++ b/net/ipv6/ip6_tunnel.c |
| @@ -307,11 +307,13 @@ static struct ip6_tnl *ip6_tnl_create(st |
| char name[IFNAMSIZ]; |
| int err; |
| |
| - if (p->name[0]) |
| + if (p->name[0]) { |
| + if (!dev_valid_name(p->name)) |
| + goto failed; |
| strlcpy(name, p->name, IFNAMSIZ); |
| - else |
| + } else { |
| sprintf(name, "ip6tnl%%d"); |
| - |
| + } |
| dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup); |
| if (dev == NULL) |
| goto failed; |
