From 092a872d6e8009ef547dc66274936dc879c55419 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Tue, 27 Apr 2010 10:43:24 -0700 Subject: [PATCH] datapath: Always null-terminate network device name in create_dp(). strncpy() does not null-terminate its output buffer if the source string's length is at least as large as its 'count' argument. We know that the source and destination buffers are the same size and that the source buffer is null-terminated, so just use strcpy(). This fixes a kernel BUG message that often occurred when strlen(devname) was exactly IFNAMSIZ-1. In such a case, if internal_dev_port.devname[IFNAMSIZ-1] happened to be nonzero, it would eventually fail the following check in alloc_netdev_mq(): BUG_ON(strlen(name) >= sizeof(dev->name)); Bug #2722. --- datapath/datapath.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/datapath/datapath.c b/datapath/datapath.c index be16044d..e9590f75 100644 --- a/datapath/datapath.c +++ b/datapath/datapath.c @@ -246,7 +246,8 @@ static int create_dp(int dp_idx, const char __user *devnamep) goto err_free_dp; /* Set up our datapath device. */ - strncpy(internal_dev_port.devname, devname, IFNAMSIZ - 1); + BUILD_BUG_ON(sizeof(internal_dev_port.devname) != sizeof(devname)); + strcpy(internal_dev_port.devname, devname); internal_dev_port.flags = ODP_PORT_INTERNAL; err = new_dp_port(dp, &internal_dev_port, ODPP_LOCAL); if (err) { -- 2.30.2