| From 000ade8016400d93b4d7c89970d96b8c14773d45 Mon Sep 17 00:00:00 2001 |
| From: Sultan Alsawaf <sultanxda@gmail.com> |
| Date: Wed, 6 Jun 2018 15:56:54 -0700 |
| Subject: ip_tunnel: Fix name string concatenate in __ip_tunnel_create() |
| |
| From: Sultan Alsawaf <sultanxda@gmail.com> |
| |
| commit 000ade8016400d93b4d7c89970d96b8c14773d45 upstream. |
| |
| By passing a limit of 2 bytes to strncat, strncat is limited to writing |
| fewer bytes than what it's supposed to append to the name here. |
| |
| Since the bounds are checked on the line above this, just remove the string |
| bounds checks entirely since they're unneeded. |
| |
| Signed-off-by: Sultan Alsawaf <sultanxda@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/ipv4/ip_tunnel.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/ipv4/ip_tunnel.c |
| +++ b/net/ipv4/ip_tunnel.c |
| @@ -310,8 +310,8 @@ static struct net_device *__ip_tunnel_cr |
| } else { |
| if (strlen(ops->kind) > (IFNAMSIZ - 3)) |
| goto failed; |
| - strlcpy(name, ops->kind, IFNAMSIZ); |
| - strncat(name, "%d", 2); |
| + strcpy(name, ops->kind); |
| + strcat(name, "%d"); |
| } |
| |
| ASSERT_RTNL(); |
