drivers/net/usb: Remove all strcpy() uses

strcpy() performs no bounds checking on the destination buffer. This
could result in linear overflows beyond the end of the buffer, leading
to all kinds of misbehaviors. The safe replacement is strscpy().

Signed-off-by: Len Baker <len.baker@gmx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 207e59e74935aaf4b23add136b611d3138a6349b..06e2181e58108ba84973b346f5ea9a3cac66bd53 100644 (file)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -443,7 +443,7 @@ static int ipheth_probe(struct usb_interface *intf,
 
        netdev->netdev_ops = &ipheth_netdev_ops;
        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
-       strcpy(netdev->name, "eth%d");
+       strscpy(netdev->name, "eth%d", sizeof(netdev->name));
 
        dev = netdev_priv(netdev);
        dev->udev = udev;

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 470e1c1e6353532a1f653c2b3cc25b83d534d78e..840c1c2ab16afa192b15b17760de1f0dd384aed5 100644 (file)
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1725,7 +1725,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        dev->interrupt_count = 0;
 
        dev->net = net;
-       strcpy (net->name, "usb%d");
+       strscpy(net->name, "usb%d", sizeof(net->name));
        memcpy (net->dev_addr, node_id, sizeof node_id);
 
        /* rx and tx sides can use different message sizes;
@@ -1752,13 +1752,13 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
                    ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
                     (net->dev_addr [0] & 0x02) == 0))
-                       strcpy (net->name, "eth%d");
+                       strscpy(net->name, "eth%d", sizeof(net->name));
                /* WLAN devices should always be named "wlan%d" */
                if ((dev->driver_info->flags & FLAG_WLAN) != 0)
-                       strcpy(net->name, "wlan%d");
+                       strscpy(net->name, "wlan%d", sizeof(net->name));
                /* WWAN devices should always be named "wwan%d" */
                if ((dev->driver_info->flags & FLAG_WWAN) != 0)
-                       strcpy(net->name, "wwan%d");
+                       strscpy(net->name, "wwan%d", sizeof(net->name));
 
                /* devices that cannot do ARP */
                if ((dev->driver_info->flags & FLAG_NOARP) != 0)