ip_tunnel: Fix name string concatenate in __ip_tunnel_create()

commit 000ade8016400d93b4d7c89970d96b8c14773d45 upstream.

By passing a limit of 2 bytes to strncat, strncat is limited to writing
fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string
bounds checks entirely since they're unneeded.

Signed-off-by: Sultan Alsawaf <sultanxda@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 72eee34092ae482764aacb3bfc30af1d25990d6f..fabc299cb875f51cc572bd7fa301a7436e7e24e5 100644 (file)
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
        } else {
                if (strlen(ops->kind) > (IFNAMSIZ - 3))
                        goto failed;
-               strlcpy(name, ops->kind, IFNAMSIZ);
-               strncat(name, "%d", 2);
+               strcpy(name, ops->kind);
+               strcat(name, "%d");
        }
 
        ASSERT_RTNL();