Commit 000ade80 authored Jun 06, 2018 by Sultan Alsawaf Committed by David S. Miller Jun 07, 2018

ip_tunnel: Fix name string concatenate in __ip_tunnel_create()



By passing a limit of 2 bytes to strncat, strncat is limited to writing
fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string
bounds checks entirely since they're unneeded.

Signed-off-by: Sultan Alsawaf <sultanxda@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 52acf73b

net/ipv4/ip_tunnel.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -261,8 +261,8 @@ static struct net_device __ip_tunnel_create(struct net net,
		} else {
		if (strlen(ops->kind) > (IFNAMSIZ - 3))
		goto failed;
		strlcpy(name, ops->kind, IFNAMSIZ);
		strncat(name, "%d", 2);
		strcpy(name, ops->kind);
		strcat(name, "%d");
		}

		ASSERT_RTNL();

Admin message