Re: [PATCH] net: tun: fix strscpy call with missing size argument
From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Date: 2025-08-14 18:16:03
Also in:
lkml
On Thu, Aug 14, 2025 at 7:23 PM Zhang Tengfei [off-list ref] wrote:
The tun_set_iff() and tun_get_iff() functions call strscpy()
with only two arguments, omitting the destination buffer size.
This patch corrects these calls by providing the required size
argument using the IFNAMSIZ macro. This ensures the code adheres
to the function's documented contract and improves its overall
robustness and clarity.
Fixes: a57384110dc6 ("tun: replace strcpy with strscpy for ifr_name")
Signed-off-by: Zhang Tengfei <redacted>The two argument choice is intentional. In that case the length is taken from the struct field sizes, which is more robust than an explicit argument. https://lore.kernel.org/netdev/6899fde3dbfd6_532b129461@willemb.c.googlers.com.notmuch/ (local)
quoted hunk
--- drivers/net/tun.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 86a9e927d0ff..88c440c99542 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c@@ -2823,13 +2823,13 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) if (netif_running(tun->dev)) netif_tx_wake_all_queues(tun->dev); - strscpy(ifr->ifr_name, tun->dev->name); + strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ); return 0; } static void tun_get_iff(struct tun_struct *tun, struct ifreq *ifr) { - strscpy(ifr->ifr_name, tun->dev->name); + strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ); ifr->ifr_flags = tun_flags(tun); --2.47.3