| From 3663a26c838de7bdcbf5982d9e64a9dfef838563 Mon Sep 17 00:00:00 2001 |
| From: Dominik Czarnota <dominik.b.czarnota@gmail.com> |
| Date: Mon, 9 Mar 2020 16:22:50 +0100 |
| Subject: [PATCH] sxgbe: Fix off by one in samsung driver strncpy size arg |
| |
| commit f3cc008bf6d59b8d93b4190e01d3e557b0040e15 upstream. |
| |
| This patch fixes an off-by-one error in strncpy size argument in |
| drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c. The issue is that in: |
| |
| strncmp(opt, "eee_timer:", 6) |
| |
| the passed string literal: "eee_timer:" has 10 bytes (without the NULL |
| byte) and the passed size argument is 6. As a result, the logic will |
| also accept other, malformed strings, e.g. "eee_tiXXX:". |
| |
| This bug doesn't seem to have any security impact since its present in |
| module's cmdline parsing code. |
| |
| Signed-off-by: Dominik Czarnota <dominik.b.czarnota@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c |
| index c56fcbb37066..38767d797914 100644 |
| --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c |
| +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c |
| @@ -2279,7 +2279,7 @@ static int __init sxgbe_cmdline_opt(char *str) |
| if (!str || !*str) |
| return -EINVAL; |
| while ((opt = strsep(&str, ",")) != NULL) { |
| - if (!strncmp(opt, "eee_timer:", 6)) { |
| + if (!strncmp(opt, "eee_timer:", 10)) { |
| if (kstrtoint(opt + 10, 0, &eee_timer)) |
| goto err; |
| } |
| -- |
| 2.7.4 |
| |
