Always copy IFNAMSIZ bytes on ioctl(SIOCGIFNAME)
authornorly <ny-git@enpas.org>
Tue, 19 Feb 2019 19:19:53 +0000 (20:19 +0100)
committernorly <ny-git@enpas.org>
Tue, 19 Feb 2019 19:19:53 +0000 (20:19 +0100)
Just in case dev->name is ever not NUL terminated

module/elmcan.c

index abdf8b561eef2dbd9bb23a2661fca2292d8d3fc0..10ca30874c662885ac8382949c97352b2af8d574 100644 (file)
@@ -1273,15 +1273,13 @@ static int elmcan_ldisc_ioctl(struct tty_struct *tty, struct file *file,
                        unsigned int cmd, unsigned long arg)
 {
        struct elmcan *elm = get_elm(tty);
-       unsigned int tmp;
 
        if (!elm)
                return -EINVAL;
 
        switch (cmd) {
        case SIOCGIFNAME:
-               tmp = strlen(elm->dev->name) + 1;
-               if (copy_to_user((void __user *)arg, elm->dev->name, tmp)) {
+               if (copy_to_user((void __user *)arg, elm->dev->name, IFNAMSIZ)) {
                        put_elm(elm);
                        return -EFAULT;
                }