From: Ben Pfaff <blp@nicira.com>
Date: Tue, 27 Apr 2010 19:41:11 +0000 (-0700)
Subject: vport: Better handle too-long network device names in vport_del().
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=21291d67574ae857d028c40b2fcc1116b6be6dfa;p=openvswitch

vport: Better handle too-long network device names in vport_del().

The 'count' argument to strncpy_from_user() is supposed to include space
for the null terminator, so add it in.  Also, refuse names that have more
than IFNAMSIZ-1 characters outright, instead of truncating them.
---

diff --git a/datapath/vport.c b/datapath/vport.c
index ef4d7db2..9ed7cd16 100644
--- a/datapath/vport.c
+++ b/datapath/vport.c
@@ -277,10 +277,13 @@ vport_del(const char __user *udevname)
 	struct vport *vport;
 	struct dp_port *dp_port;
 	int err = 0;
+	int retval;
 
-	if (strncpy_from_user(devname, udevname, IFNAMSIZ - 1) < 0)
+	retval = strncpy_from_user(devname, udevname, IFNAMSIZ);
+	if (retval < 0)
 		return -EFAULT;
-	devname[IFNAMSIZ - 1] = '\0';
+	else if (retval >= IFNAMSIZ)
+		return -ENAMETOOLONG;
 
 	rtnl_lock();