linux-kernel - [PATCH] net: tun: fix strscpy call with missing size argument

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250814172300.57458-1-zhtfdev@gmail.com>
Date: Fri, 15 Aug 2025 01:23:00 +0800
From: Zhang Tengfei <zhtfdev@...il.com>
To: Miguel García <miguelgarciaroman8@...il.com>,
	ason Wang <jasowang@...hat.com>,
	Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>,
	"Andrew Lunn --cc=netdev @ vger . kernel . org" <andrew+netdev@...n.ch>,
	linux-kernel@...r.kernel.org,
	Zhang Tengfei <zhtfdev@...il.com>
Subject: [PATCH] net: tun: fix strscpy call with missing size argument

The tun_set_iff() and tun_get_iff() functions call strscpy()
with only two arguments, omitting the destination buffer size.

This patch corrects these calls by providing the required size
argument using the IFNAMSIZ macro. This ensures the code adheres
to the function's documented contract and improves its overall
robustness and clarity.

Fixes: a57384110dc6 ("tun: replace strcpy with strscpy for ifr_name")
Signed-off-by: Zhang Tengfei <zhtfdev@...il.com>
---
 drivers/net/tun.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 86a9e927d0ff..88c440c99542 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2823,13 +2823,13 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 	if (netif_running(tun->dev))
 		netif_tx_wake_all_queues(tun->dev);
 
-	strscpy(ifr->ifr_name, tun->dev->name);
+	strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ);
 	return 0;
 }
 
 static void tun_get_iff(struct tun_struct *tun, struct ifreq *ifr)
 {
-	strscpy(ifr->ifr_name, tun->dev->name);
+	strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ);
 
 	ifr->ifr_flags = tun_flags(tun);
 
-- 
2.47.3