Re: [PATCH v2] core: dev: don't call BUG() on bad input

Alexey,

On Mon, Feb 14, 2011 at 17:16 +0200, Alexey Dobriyan wrote:

On Mon, Feb 14, 2011 at 4:42 PM, Vasiliy Kulikov [off-list ref] wrote:

quoted

alloc_netdev() may be called with too long name (more that IFNAMSIZ bytes).
Currently this leads to BUG().  Other insane inputs (bad txqs, rxqs) and
even OOM don't lead to BUG().  Made alloc_netdev() return NULL, like on
other errors.

quoted

--- a/net/core/dev.c
+++ b/net/core/dev.c

@@ -5761,7 +5761,10 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,

       size_t alloc_size;
       struct net_device *p;

-       BUG_ON(strlen(name) >= sizeof(dev->name));
+       if (strnlen(name, sizeof(dev->name)) >= sizeof(dev->name)) {
+               pr_err("alloc_netdev: Too long device name\n");
+               return NULL;
+       }

Netdevice name isn't some random junk you get from userspace, so BUG is fine.

It IS for bluetooth, see net/bluetooth/bnep/core.c: bnep_add_connection() and
net/bluetooth/bnep/sock.c: bnep_sock_ioctl(). 

And txqs, txqs?  Then why do not BUG() on bad txqs too?  Why so
insonsistent?  BUG() should be called in some critical situation, net
device creation is probably not such a thing.


Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments