Commit 42906b1d authored by Sultan Alsawaf's avatar Sultan Alsawaf Committed by Kleber Sacilotto de Souza

ip_tunnel: Fix name string concatenate in __ip_tunnel_create()

BugLink: https://bugs.launchpad.net/bugs/1811077

commit 000ade80 upstream.

By passing a limit of 2 bytes to strncat, strncat is limited to writing
fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string
bounds checks entirely since they're unneeded.
Signed-off-by: default avatarSultan Alsawaf <sultanxda@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJuerg Haefliger <juergh@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent c1982ea1
......@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
} else {
if (strlen(ops->kind) > (IFNAMSIZ - 3))
goto failed;
strlcpy(name, ops->kind, IFNAMSIZ);
strncat(name, "%d", 2);
strcpy(name, ops->kind);
strcat(name, "%d");
}
ASSERT_RTNL();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment