| From foo@baz Thu Jun 29 19:45:34 CEST 2017 |
| From: Alexander Potapenko <glider@google.com> |
| Date: Tue, 6 Jun 2017 15:56:54 +0200 |
| Subject: net: don't call strlen on non-terminated string in dev_set_alias() |
| |
| From: Alexander Potapenko <glider@google.com> |
| |
| |
| [ Upstream commit c28294b941232931fbd714099798eb7aa7e865d7 ] |
| |
| KMSAN reported a use of uninitialized memory in dev_set_alias(), |
| which was caused by calling strlcpy() (which in turn called strlen()) |
| on the user-supplied non-terminated string. |
| |
| Signed-off-by: Alexander Potapenko <glider@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/core/dev.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/net/core/dev.c |
| +++ b/net/core/dev.c |
| @@ -1194,8 +1194,9 @@ int dev_set_alias(struct net_device *dev |
| if (!new_ifalias) |
| return -ENOMEM; |
| dev->ifalias = new_ifalias; |
| + memcpy(dev->ifalias, alias, len); |
| + dev->ifalias[len] = 0; |
| |
| - strlcpy(dev->ifalias, alias, len+1); |
| return len; |
| } |
| |
