提交 93b3cff9 编写于 作者: W Wang Chen 提交者: David S. Miller

netdevice: Fix wrong string handle in kernel command line parsing

v1->v2: Use strlcpy() to ensure s[i].name be null-termination.

1. In netdev_boot_setup_add(), a long name will leak.
   ex. : dev=21,0x1234,0x1234,0x2345,eth123456789verylongname.........
2. In netdev_boot_setup_check(), mismatch will happen if s[i].name
   is a substring of dev->name.
   ex. : dev=...eth1 dev=...eth11

[ With feedback from Ben Hutchings. ]
Signed-off-by: NWang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 8fde8a07
...@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map) ...@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) { for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
if (s[i].name[0] == '\0' || s[i].name[0] == ' ') { if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
memset(s[i].name, 0, sizeof(s[i].name)); memset(s[i].name, 0, sizeof(s[i].name));
strcpy(s[i].name, name); strlcpy(s[i].name, name, IFNAMSIZ);
memcpy(&s[i].map, map, sizeof(s[i].map)); memcpy(&s[i].map, map, sizeof(s[i].map));
break; break;
} }
...@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev) ...@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)
for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) { for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
if (s[i].name[0] != '\0' && s[i].name[0] != ' ' && if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
!strncmp(dev->name, s[i].name, strlen(s[i].name))) { !strcmp(dev->name, s[i].name)) {
dev->irq = s[i].map.irq; dev->irq = s[i].map.irq;
dev->base_addr = s[i].map.base_addr; dev->base_addr = s[i].map.base_addr;
dev->mem_start = s[i].map.mem_start; dev->mem_start = s[i].map.mem_start;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册