diff options
author | Wang Chen <wangchen@cn.fujitsu.com> | 2008-07-01 22:57:19 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-07-01 22:57:19 -0400 |
commit | 93b3cff9915322d6fa36bac0064714a7076230e4 (patch) | |
tree | f17f0fd69b2c5c930b29f5e40b214d6a458cbbfc /net/core/dev.c | |
parent | 8fde8a076940969d32805b853efdce8b988d7dda (diff) |
netdevice: Fix wrong string handle in kernel command line parsing
v1->v2: Use strlcpy() to ensure s[i].name be null-termination.
1. In netdev_boot_setup_add(), a long name will leak.
ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname.........
2. In netdev_boot_setup_check(), mismatch will happen if s[i].name
is a substring of dev->name.
ex. : dev=...eth1 dev=...eth11
[ With feedback from Ben Hutchings. ]
Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/dev.c')
-rw-r--r-- | net/core/dev.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 56b46579ff4e..fca23a3bf12c 100644 --- a/net/core/dev.c +++ b/net/core/dev.c | |||
@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map) | |||
454 | for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) { | 454 | for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) { |
455 | if (s[i].name[0] == '\0' || s[i].name[0] == ' ') { | 455 | if (s[i].name[0] == '\0' || s[i].name[0] == ' ') { |
456 | memset(s[i].name, 0, sizeof(s[i].name)); | 456 | memset(s[i].name, 0, sizeof(s[i].name)); |
457 | strcpy(s[i].name, name); | 457 | strlcpy(s[i].name, name, IFNAMSIZ); |
458 | memcpy(&s[i].map, map, sizeof(s[i].map)); | 458 | memcpy(&s[i].map, map, sizeof(s[i].map)); |
459 | break; | 459 | break; |
460 | } | 460 | } |
@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev) | |||
479 | 479 | ||
480 | for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) { | 480 | for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) { |
481 | if (s[i].name[0] != '\0' && s[i].name[0] != ' ' && | 481 | if (s[i].name[0] != '\0' && s[i].name[0] != ' ' && |
482 | !strncmp(dev->name, s[i].name, strlen(s[i].name))) { | 482 | !strcmp(dev->name, s[i].name)) { |
483 | dev->irq = s[i].map.irq; | 483 | dev->irq = s[i].map.irq; |
484 | dev->base_addr = s[i].map.base_addr; | 484 | dev->base_addr = s[i].map.base_addr; |
485 | dev->mem_start = s[i].map.mem_start; | 485 | dev->mem_start = s[i].map.mem_start; |