ip_tunnel: Fix name string concatenate in __ip_tunnel_create()

commit 000ade8016400d93b4d7c89970d96b8c14773d45 upstream.

By passing a limit of 2 bytes to strncat, strncat is limited to writing
fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string
bounds checks entirely since they're unneeded.

Signed-off-by: Sultan Alsawaf <sultanxda@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sw0312.kim: cherry-pick stable linux-4.9.y commit 5569c10858be for gcc 9 build]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ida4f04d469c4d91f12faa5fe46bd443c43bfe333

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index bd7f1836bb703c7c7dff315d86381863b5328527..7a7a3f58438e1625ae7c0eb5a62af30d67e39e14 100644 (file)
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -260,8 +260,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
                        err = -E2BIG;
                        goto failed;
                }
-               strlcpy(name, ops->kind, IFNAMSIZ);
-               strncat(name, "%d", 2);
+               strcpy(name, ops->kind);
+               strcat(name, "%d");
        }
 
        ASSERT_RTNL();