[PATCH net 1/1] net: arp: reject unterminated device names

From: Zijie Huang <[email protected]>

The ARP ioctl copies a user-provided struct arpreq into a stack object. Its
arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.

Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where
strcmp() can read past the end of the stack object when a matching
alternative interface name exists.

Reject non-terminated device names with -EINVAL before the lookup to
prevent the out-of-bounds read.

Fixes: ff92741270bf ("net: introduce name_node struct to be used in hashlist")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Assisted-by: LLM
Signed-off-by: Zijie Huang <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
 net/ipv4/arp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index d409f606aec0..9e3cf46b7f6c 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1278,6 +1278,8 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 		err = copy_from_user(&r, arg, sizeof(struct arpreq));
 		if (err)
 			return -EFAULT;
+		if (strnlen(r.arp_dev, IFNAMSIZ) == IFNAMSIZ)
+			return -EINVAL;
 		break;
 	default:
 		return -EINVAL;
-- 
2.47.3