Commit 27e32b55 authored by Dominik Czarnota's avatar Dominik Czarnota Committed by Kelsey Skunberg

sxgbe: Fix off by one in samsung driver strncpy size arg

BugLink: https://bugs.launchpad.net/bugs/1873852

[ Upstream commit f3cc008b ]

This patch fixes an off-by-one error in strncpy size argument in
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c. The issue is that in:

        strncmp(opt, "eee_timer:", 6)

the passed string literal: "eee_timer:" has 10 bytes (without the NULL
byte) and the passed size argument is 6. As a result, the logic will
also accept other, malformed strings, e.g. "eee_tiXXX:".

This bug doesn't seem to have any security impact since its present in
module's cmdline parsing code.
Signed-off-by: default avatarDominik Czarnota <dominik.b.czarnota@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: default avatarKelsey Skunberg <kelsey.skunberg@canonical.com>
parent d928a996
...@@ -2315,7 +2315,7 @@ static int __init sxgbe_cmdline_opt(char *str) ...@@ -2315,7 +2315,7 @@ static int __init sxgbe_cmdline_opt(char *str)
if (!str || !*str) if (!str || !*str)
return -EINVAL; return -EINVAL;
while ((opt = strsep(&str, ",")) != NULL) { while ((opt = strsep(&str, ",")) != NULL) {
if (!strncmp(opt, "eee_timer:", 6)) { if (!strncmp(opt, "eee_timer:", 10)) {
if (kstrtoint(opt + 10, 0, &eee_timer)) if (kstrtoint(opt + 10, 0, &eee_timer))
goto err; goto err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment