caif: add a sanity check to the tty name

"tty->name" and "name" are a 64 character buffers.  My static checker
complains because we add the "cf" on the front so it look like we are
copying a 66 character string into a 64 character buffer.

Also if the name is larger than IFNAMSIZ (16) it triggers a BUG_ON()
inside the call to alloc_netdev().

This is all under CAP_SYS_ADMIN so it's not a security fix, it just adds
a little robustness.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 34dea95d58dbf3fd06e0a83e4965b77e63bd3946..88a6a5810ec6820a1e8f2b674021a4a142804885 100644 (file)
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -347,7 +347,9 @@ static int ldisc_open(struct tty_struct *tty)
        /* release devices to avoid name collision */
        ser_release(NULL);
 
-       sprintf(name, "cf%s", tty->name);
+       result = snprintf(name, sizeof(name), "cf%s", tty->name);
+       if (result >= IFNAMSIZ)
+               return -EINVAL;
        dev = alloc_netdev(sizeof(*ser), name, caifdev_setup);
        if (!dev)
                return -ENOMEM;