Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1689671
| From | "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH] wireless: wext: terminate ifr name coming from userspace |
| Date | 2017-07-18 06:30 +0200 |
| Message-ID | <u4sj0-67a-23@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
ifr name is assumed to be a valid string by the kernel, but nothing was forcing username to pass a valid string. In turn, this would cause panics as we tried to access the string past it's valid memory. Signed-off-by: Sasha Levin <alexander.levin@verizon.com> --- net/core/dev_ioctl.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) index 82fd4c9c4a1b..7657ad6bc13d 100644 --- a/net/core/dev_ioctl.c +++ b/net/core/dev_ioctl.c @@ -424,6 +424,8 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) if (copy_from_user(&iwr, arg, sizeof(iwr))) return -EFAULT; + iwr.ifr_name[sizeof(iwr.ifr_name) - 1] = 0; + return wext_handle_ioctl(net, &iwr, cmd, arg); } -- 2.11.0
Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread
[PATCH] wireless: wext: terminate ifr name coming from userspace "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-18 06:30 +0200 Re: [PATCH] wireless: wext: terminate ifr name coming from userspace David Miller <davem@davemloft.net> - 2017-07-19 22:40 +0200
csiph-web