ioctl(SIOCGIFNAME): Copy at most IFNAMSIZ bytes, but less if possible

Thus, we don't leak any trailing bytes that may be in the name buffer.

diff --git a/module/elmcan.c b/module/elmcan.c
index 10ca30874c662885ac8382949c97352b2af8d574..538134cf38f71666bfe310da68c8378429232889 100644 (file)
--- a/module/elmcan.c
+++ b/module/elmcan.c
@@ -1273,13 +1273,15 @@ static int elmcan_ldisc_ioctl(struct tty_struct *tty, struct file *file,
                        unsigned int cmd, unsigned long arg)
 {
        struct elmcan *elm = get_elm(tty);
+       unsigned int tmp;
 
        if (!elm)
                return -EINVAL;
 
        switch (cmd) {
        case SIOCGIFNAME:
-               if (copy_to_user((void __user *)arg, elm->dev->name, IFNAMSIZ)) {
+               tmp = strnlen(elm->dev->name, IFNAMSIZ - 1) + 1;
+               if (copy_to_user((void __user *)arg, elm->dev->name, tmp)) {
                        put_elm(elm);
                        return -EFAULT;
                }