Re: [PATCH] lib: introduce strdup_from_user

[Al Viro <viro@ZenIV.linux.org.uk>]

On Fri, Jun 03, 2011 at 10:12:37PM +0300, Alexey Dobriyan wrote:

> Because now you're lucky C strings are NUL-terminated.
> If this "idiom" applies to some other case like "validate + copy",
> we have a bug.
> 
> We copy data to kernelspace THEN validate or copy or whatever.
> This is obviously correct and safe.

In this case we don't know how _much_ needs to be copied, and that information
comes precisely from NUL-termination.  IOW, it's not a matter of luck at all.

"Copy the amount of bytes equal to the limit given to us, then truncate if
needed" is seriously broken in this case.  Think what happens if you have
a short string sitting in the middle of a page, with the next page not
mapped at all.  And ask to copy up to 4096 bytes.  The string itself is
much shorter than that.  However, trying to blindly copy those 4096 bytes
will give you -EFAULT.  Which is not what we want when copying strings
from userland.

We certainly do not want to *reread* them, but this "find the length, then
copy that much" is just fine.