Commit 98de4e0e authored Jul 18, 2017 by Levin, Alexander Committed by David S. Miller Jul 19, 2017

wireless: wext: terminate ifr name coming from userspace



ifr name is assumed to be a valid string by the kernel, but nothing
was forcing username to pass a valid string.

In turn, this would cause panics as we tried to access the string
past it's valid memory.

Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 073dd5ad

net/core/dev_ioctl.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -424,6 +424,8 @@ int dev_ioctl(struct net net, unsigned int cmd, void __user arg)
		if (copy_from_user(&iwr, arg, sizeof(iwr)))
		return -EFAULT;

		iwr.ifr_name[sizeof(iwr.ifr_name) - 1] = 0;

		return wext_handle_ioctl(net, &iwr, cmd, arg);
		}