Commit ded4a02e authored by Thorsten Blum's avatar Thorsten Blum Committed by Jakub Kicinski
Browse files

ipv6: sit: Replace deprecated strcpy with strscpy 

strcpy() has been deprecated [1] because it performs no bounds checking
on the destination buffer, which can lead to buffer overflows. Replace
it with the safer strscpy().  Use the two-argument version of strscpy()
to copy 'parms->name' in ipip6_tunnel_locate().

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy

 [1]
Signed-off-by: default avatarThorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260227004541.798966-3-thorsten.blum@linux.dev


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent eed562b2

net/ipv6/sit.c

+6 −5
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include <linux/types.h>

#include <linux/socket.h>

#include <linux/sockios.h>

#include <linux/string.h>

#include <linux/net.h>

#include <linux/in6.h>

#include <linux/netdevice.h>
@@ -256,9 +257,9 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net, 
	if (parms->name[0]) {

		if (!dev_valid_name(parms->name))

			goto failed;

		strscpy(name, parms->name, IFNAMSIZ);

		strscpy(name, parms->name);

	} else {

		strcpy(name, "sit%d");

		strscpy(name, "sit%d");

	}

	dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,

			   ipip6_tunnel_setup);
@@ -275,7 +276,7 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net, 
		goto failed_free;



	if (!parms->name[0])

		strcpy(parms->name, dev->name);

		strscpy(parms->name, dev->name);



	return nt;
@@ -1442,7 +1443,7 @@ static int ipip6_tunnel_init(struct net_device *dev) 
	int err;



	tunnel->dev = dev;

	strcpy(tunnel->parms.name, dev->name);

	strscpy(tunnel->parms.name, dev->name);



	ipip6_tunnel_bind_dev(dev);
@@ -1863,7 +1864,7 @@ static int __net_init sit_init_net(struct net *net) 
	ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);

	ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);



	strcpy(t->parms.name, sitn->fb_tunnel_dev->name);

	strscpy(t->parms.name, sitn->fb_tunnel_dev->name);

	return 0;



err_reg_dev: