Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e5666cd authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

mISDN: make sure device name is NUL terminated 



[ Upstream commit ccfb62f27beb295103e9392462b20a6ed807d0ea ]

The user can change the device_name with the IMSETDEVNAME ioctl, but we
need to ensure that the user's name is NUL terminated.  Otherwise it
could result in a buffer overflow when we copy the name back to the user
with IMGETDEVINFO ioctl.

I also changed two strcpy() calls which handle the name to strscpy().
Hopefully, there aren't any other ways to create a too long name, but
it's nice to do this as a kernel hardening measure.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent f3885eec

drivers/isdn/mISDN/socket.c

+3 −2
Original line number Diff line number Diff line
@@ -394,7 +394,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
			memcpy(di.channelmap, dev->channelmap,

			       sizeof(di.channelmap));

			di.nrbchan = dev->nrbchan;

			strcpy(di.name, dev_name(&dev->dev));

			strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));

			if (copy_to_user((void __user *)arg, &di, sizeof(di)))

				err = -EFAULT;

		} else
@@ -677,7 +677,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
			memcpy(di.channelmap, dev->channelmap,

			       sizeof(di.channelmap));

			di.nrbchan = dev->nrbchan;

			strcpy(di.name, dev_name(&dev->dev));

			strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));

			if (copy_to_user((void __user *)arg, &di, sizeof(di)))

				err = -EFAULT;

		} else
@@ -691,6 +691,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
			err = -EFAULT;

			break;

		}

		dn.name[sizeof(dn.name) - 1] = '\0';

		dev = get_mdevice(dn.id);

		if (dev)

			err = device_rename(&dev->dev, dn.name);