linux-kernel - RE: [PATCH] staging/rtl8712: Remove all strcpy() uses in favor of strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <de94438319a84e0985b3ba0f5c00807b@AcuMS.aculab.com>
Date:   Mon, 19 Jul 2021 15:24:38 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Dan Carpenter' <dan.carpenter@...cle.com>,
        Len Baker <len.baker@....com>
CC:     Larry Finger <Larry.Finger@...inger.net>,
        Florian Schilhabel <florian.c.schilhabel@...glemail.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Pavel Skripkin <paskripkin@...il.com>,
        "linux-staging@...ts.linux.dev" <linux-staging@...ts.linux.dev>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] staging/rtl8712: Remove all strcpy() uses in favor of
 strscpy()

From: Dan Carpenter
> Sent: 19 July 2021 06:38
...
> Not related to your patch but this code is bad.  What it does is the
> "ifname" can be set as a module parameter.  So instead of testing if it
> has been set, it uses the checking inside dev_alloc_name() to see if we
> can allocate what the user requested.  If not then set it to "wlan%d".
> If we cannot allocate what the user wants then we should return an
> error.
> 
> It should do:
> 
> 	if (ifname[0] == '\0')
> 		strscpy(ifname, "wlan%d", sizeof(ifname));
> 
> 	ret = dev_alloc_name(pnetdev, ifname);
> 	if (ret < 0) {
> 		dev_err(pnetdev, "allocating device name failed.\n");
> 		return NULL;
> 	}

I know only root can set module parameters, but having one
that contains a string used as a printf format seems
dangerous at best.

Isn't it best to let userspace rename the interfaces later on?

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)