bonding: fix off-by-one error
authornikolay@redhat.com <nikolay@redhat.com>
Wed, 31 Oct 2012 04:42:51 +0000 (04:42 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 1 Nov 2012 15:53:43 +0000 (11:53 -0400)
Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.

How to reproduce:
 with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
 modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
 echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/primary;

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/bonding/bond_sysfs.c

index dc15d248443fd833ae17199a41f28ab6712b5d5c..238d9b3e2252b22c3405291edbffc5df946a4608 100644 (file)
@@ -1060,7 +1060,7 @@ static ssize_t bonding_store_primary(struct device *d,
                goto out;
        }
 
-       sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+       sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
 
        /* check to see if we are clearing primary */
        if (!strlen(ifname) || buf[0] == '\n') {