Re: [PATCH] net/rds: using strlcpy instead of strncpy

[Chen Gang <gang.chen@asianux.com>]

于 2013年03月06日 01:00, Ben Hutchings 写道:
> This function calls rds_copy_info() to copy the whole of ctr into
> userland.
> 
> If ctr is not completely initialised, then the values of the
> uninitialised bytes are left over from the local variables of an earlier
> system call.  If an attacker knows enough about the stack layout (easy
> if this is a distribution kernel), they can make a series of system
> calls that leak information about heap-allocated objects.  That can help
> them to exploit other kernel bugs for privilege escalation.  So we
> should initialise every bit of memory that is going to be copied to
> userland.
> 
> (In fact, in general it's not even enough to initialise all fields of
> the structure, because there may be padding bytes between them.  In this
> case we know there isn't, because it's declared as packed.)
> 
> Ben.

  thank you for your information.

  I should send patch v2 for it.

  :-)


-- 
Chen Gang

Asianux Corporation