From: Dan Carpenter Date: Tue, 3 Sep 2013 09:02:32 +0000 (+0300) Subject: caif: add a sanity check to the tty name X-Git-Tag: submit/tizen_common/20140905.094502~2224^2~40 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=cab6ce9ebe89303bbf5eff442776188070a22771;p=sdk%2Femulator%2Femulator-kernel.git caif: add a sanity check to the tty name "tty->name" and "name" are a 64 character buffers. My static checker complains because we add the "cf" on the front so it look like we are copying a 66 character string into a 64 character buffer. Also if the name is larger than IFNAMSIZ (16) it triggers a BUG_ON() inside the call to alloc_netdev(). This is all under CAP_SYS_ADMIN so it's not a security fix, it just adds a little robustness. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller --- diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c index 34dea95..88a6a58 100644 --- a/drivers/net/caif/caif_serial.c +++ b/drivers/net/caif/caif_serial.c @@ -347,7 +347,9 @@ static int ldisc_open(struct tty_struct *tty) /* release devices to avoid name collision */ ser_release(NULL); - sprintf(name, "cf%s", tty->name); + result = snprintf(name, sizeof(name), "cf%s", tty->name); + if (result >= IFNAMSIZ) + return -EINVAL; dev = alloc_netdev(sizeof(*ser), name, caifdev_setup); if (!dev) return -ENOMEM;