* Re: [PATCH] s390 keyboard: Avoid off-by-one when using strnlen_user()
[not found] <20150603084742.GD13054@quack.suse.cz>
@ 2015-06-03 12:27 ` Heiko Carstens
0 siblings, 0 replies; only message in thread
From: Heiko Carstens @ 2015-06-03 12:27 UTC (permalink / raw)
To: linux-s390
On Wed, Jun 03, 2015 at 10:47:42AM +0200, Jan Kara wrote:
> On Wed 03-06-15 09:50:30, Martin Schwidefsky wrote:
> > On Tue, 2 Jun 2015 17:07:33 +0200
> > Jan Kara <jack@suse.cz> wrote:
> >
> > > strnlen_user() returns the length of the string including terminating 0.
> > > So avoid counting it again and unnecessarily reducing maximum string
> > > size by 1.
> > >
> > > CC: Heiko Carstens <heiko.carstens@de.ibm.com>
> > > Signed-off-by: Jan Kara <jack@suse.cz>
[...]
> >
> > The simplification with the string length is nice but removing
> > the explicit NUL termination is imho a mistake. Who guarantees
> > you that the string in user space is still the same after the
> > initial strnlen_user? It might have changed before the
> > copy_from_user call and then we end up with an unterminated
> > string in the kernel. Not good.
> Ah, that's a good point. Thanks for catching this. But it would deserve
> a comment in the code. Attached is an updated patch.
Nice ;) I applied your updated patch instead.
Thanks!
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2015-06-03 12:27 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20150603084742.GD13054@quack.suse.cz>
2015-06-03 12:27 ` [PATCH] s390 keyboard: Avoid off-by-one when using strnlen_user() Heiko Carstens
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.