net: tun: fix strscpy call with missing size argument

[PATCH] net: tun: fix strscpy call with missing size argument

Posted by Zhang Tengfei 1 month, 2 weeks ago

The tun_set_iff() and tun_get_iff() functions call strscpy()
with only two arguments, omitting the destination buffer size.

This patch corrects these calls by providing the required size
argument using the IFNAMSIZ macro. This ensures the code adheres
to the function's documented contract and improves its overall
robustness and clarity.

Fixes: a57384110dc6 ("tun: replace strcpy with strscpy for ifr_name")
Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
---
 drivers/net/tun.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 86a9e927d0ff..88c440c99542 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2823,13 +2823,13 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 	if (netif_running(tun->dev))
 		netif_tx_wake_all_queues(tun->dev);
 
-	strscpy(ifr->ifr_name, tun->dev->name);
+	strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ);
 	return 0;
 }
 
 static void tun_get_iff(struct tun_struct *tun, struct ifreq *ifr)
 {
-	strscpy(ifr->ifr_name, tun->dev->name);
+	strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ);
 
 	ifr->ifr_flags = tun_flags(tun);
 
-- 
2.47.3

Re: [PATCH] net: tun: fix strscpy call with missing size argument

Posted by Willem de Bruijn 1 month, 2 weeks ago

On Thu, Aug 14, 2025 at 7:23 PM Zhang Tengfei <zhtfdev@gmail.com> wrote:
>
> The tun_set_iff() and tun_get_iff() functions call strscpy()
> with only two arguments, omitting the destination buffer size.
>
> This patch corrects these calls by providing the required size
> argument using the IFNAMSIZ macro. This ensures the code adheres
> to the function's documented contract and improves its overall
> robustness and clarity.
>
> Fixes: a57384110dc6 ("tun: replace strcpy with strscpy for ifr_name")
> Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>

The two argument choice is intentional. In that case the length is
taken from the struct field sizes, which is more robust than an
explicit argument.

https://lore.kernel.org/netdev/6899fde3dbfd6_532b129461@willemb.c.googlers.com.notmuch/


> ---
>  drivers/net/tun.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 86a9e927d0ff..88c440c99542 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -2823,13 +2823,13 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
>         if (netif_running(tun->dev))
>                 netif_tx_wake_all_queues(tun->dev);
>
> -       strscpy(ifr->ifr_name, tun->dev->name);
> +       strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ);
>         return 0;
>  }
>
>  static void tun_get_iff(struct tun_struct *tun, struct ifreq *ifr)
>  {
> -       strscpy(ifr->ifr_name, tun->dev->name);
> +       strscpy(ifr->ifr_name, tun->dev->name, IFNAMSIZ);
>
>         ifr->ifr_flags = tun_flags(tun);
>
> --
> 2.47.3
>