Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84a198ee authored by Len Baker's avatar Len Baker Committed by Greg Kroah-Hartman
Browse files

drivers/net/usb: Remove all strcpy() uses 



[ Upstream commit 493c3ca6bd754d8587604496eb814f72e933075d ]

strcpy() performs no bounds checking on the destination buffer. This
could result in linear overflows beyond the end of the buffer, leading
to all kinds of misbehaviors. The safe replacement is strscpy().

Signed-off-by: default avatarLen Baker <len.baker@gmx.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Stable-dep-of: bab8eb0dd4cb ("usbnet: modern method to get random MAC")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent c1b187a8

drivers/net/usb/ipheth.c

+1 −1
Original line number Diff line number Diff line
@@ -443,7 +443,7 @@ static int ipheth_probe(struct usb_interface *intf, 


	netdev->netdev_ops = &ipheth_netdev_ops;

	netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;

	strcpy(netdev->name, "eth%d");

	strscpy(netdev->name, "eth%d", sizeof(netdev->name));



	dev = netdev_priv(netdev);

	dev->udev = udev;

drivers/net/usb/usbnet.c

+4 −4
Original line number Diff line number Diff line
@@ -1711,7 +1711,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) 
	dev->interrupt_count = 0;



	dev->net = net;

	strcpy (net->name, "usb%d");

	strscpy(net->name, "usb%d", sizeof(net->name));

	memcpy (net->dev_addr, node_id, sizeof node_id);



	/* rx and tx sides can use different message sizes;
@@ -1738,13 +1738,13 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) 
		if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&

		    ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||

		     (net->dev_addr [0] & 0x02) == 0))

			strcpy (net->name, "eth%d");

			strscpy(net->name, "eth%d", sizeof(net->name));

		/* WLAN devices should always be named "wlan%d" */

		if ((dev->driver_info->flags & FLAG_WLAN) != 0)

			strcpy(net->name, "wlan%d");

			strscpy(net->name, "wlan%d", sizeof(net->name));

		/* WWAN devices should always be named "wwan%d" */

		if ((dev->driver_info->flags & FLAG_WWAN) != 0)

			strcpy(net->name, "wwan%d");

			strscpy(net->name, "wwan%d", sizeof(net->name));



		/* devices that cannot do ARP */

		if ((dev->driver_info->flags & FLAG_NOARP) != 0)