Re: [PATCH v3] net: don't call strlen on non-terminated string in dev_set_alias()
flat view
From: Yury Norov <hidden>
Date: 2017-06-01 13:47:57
Also in:
lkml
On Thu, Jun 01, 2017 at 02:38:29PM +0200, Alexander Potapenko wrote:
KMSAN reported a use of uninitialized memory in dev_set_alias(), which was caused by calling strlcpy() (which in turn called strlen()) on the user-supplied non-terminated string. Signed-off-by: Alexander Potapenko <glider@google.com> --- v3: removed the multi-line comment v2: fixed an off-by-one error spotted by Dmitry Vyukov
[...]
quoted hunk ↗ jump to hunk
--- net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)diff --git a/net/core/dev.c b/net/core/dev.c index fca407b4a6ea..3e3b29133cc9 100644 --- a/net/core/dev.c +++ b/net/core/dev.c@@ -1254,7 +1254,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len) return -ENOMEM; dev->ifalias = new_ifalias; - strlcpy(dev->ifalias, alias, len+1); + /* alias comes from the userspace and may not be zero-terminated. */
So if the comment is correct, you'd use copy_from_user() instead.
+ memcpy(dev->ifalias, alias, len); + dev->ifalias[len] = 0; return len; } -- 2.13.0.219.gdb65acc882-goog