netdevice: Fix wrong string handle in kernel command line parsing (93b3cff9) · Commits · 戴 / test

v1->v2: Use strlcpy() to ensure s[i].name be null-termination. 1. In netdev_boot_setup_add(), a long name will leak. ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname......... 2. In netdev_boot_setup_check(), mismatch will happen if s[i].name is a substring of dev->name. ex. : dev=...eth1 dev=...eth11 [ With feedback from Ben Hutchings. ] Signed-off-by:

Wang Chen <wangchen@cn.fujitsu.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/dev.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char name, struct ifmap map)
		for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
		if (s[i].name[0] == '\0' \|\| s[i].name[0] == ' ') {
		memset(s[i].name, 0, sizeof(s[i].name));
		strcpy(s[i].name, name);
		strlcpy(s[i].name, name, IFNAMSIZ);
		memcpy(&s[i].map, map, sizeof(s[i].map));
		break;
		}
		@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)

		for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
		if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
		!strncmp(dev->name, s[i].name, strlen(s[i].name))) {
		!strcmp(dev->name, s[i].name)) {
		dev->irq = s[i].map.irq;
		dev->base_addr = s[i].map.base_addr;
		dev->mem_start = s[i].map.mem_start;

Admin message