Re: [PATCH] net/rds: using strlcpy instead of strncpy

[Chen Gang <gang.chen@asianux.com>]

于 2013年02月28日 17:36, David Laight 写道:
>> > diff --git a/net/rds/stats.c b/net/rds/stats.c
>> > index 7be790d..b9ac1df 100644
>> > --- a/net/rds/stats.c
>> > +++ b/net/rds/stats.c
>> > @@ -86,7 +86,7 @@ void rds_stats_info_copy(struct rds_info_iterator *iter,
>> > 
>> >  	for (i = 0; i < nr; i++) {
>> >  		BUG_ON(strlen(names[i]) >= sizeof(ctr.name));
>> > -		strncpy(ctr.name, names[i], sizeof(ctr.name) - 1);
>> > +		strlcpy(ctr.name, names[i], sizeof(ctr.name));
>> >  		ctr.value = values[i];
>> > 
> If the target buffer ends up being copied to userspace that
> might lead to random kernel memory being leaked.

  excuse me, I do not quite understand what your meaning.

  I guess what you said is:
    if crt.name is not ended by '\0', it will cause issue.
    the issue is:
      "If the target buffer ends up being copied to userspace that
       might lead to random kernel memory being leaked."

  is it correct ?
    if it is correct, need I add them as patch comments, too ?
    else (incorrect), please give more descriptions, thanks.


  :-)

-- 
Chen Gang

Asianux Corporation