On Tue, 2 Jun 2015 17:07:33 +0200
Jan Kara <jack@xxxxxxx> wrote:
> strnlen_user() returns the length of the string including terminating 0.
> So avoid counting it again and unnecessarily reducing maximum string
> size by 1.
>
> CC: Heiko Carstens <heiko.carstens@xxxxxxxxxx>
> Signed-off-by: Jan Kara <jack@xxxxxxx>
> ---
> drivers/s390/char/keyboard.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
> index 01463b052ae7..e45541915a73 100644
> --- a/drivers/s390/char/keyboard.c
> +++ b/drivers/s390/char/keyboard.c
> @@ -433,20 +433,18 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
> case KDSKBSENT:
> if (!perm)
> return -EPERM;
> - len = strnlen_user(u_kbs->kb_string,
> - sizeof(u_kbs->kb_string) - 1);
> + len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string));
> if (!len)
> return -EFAULT;
> - if (len > sizeof(u_kbs->kb_string) - 1)
> + if (len > sizeof(u_kbs->kb_string))
> return -EINVAL;
> - p = kmalloc(len + 1, GFP_KERNEL);
> + p = kmalloc(len, GFP_KERNEL);
> if (!p)
> return -ENOMEM;
> if (copy_from_user(p, u_kbs->kb_string, len)) {
> kfree(p);
> return -EFAULT;
> }
> - p[len] = 0;
> kfree(kbd->func_table[kb_func]);
> kbd->func_table[kb_func] = p;
> break;
The simplification with the string length is nice but removing
the explicit NUL termination is imho a mistake. Who guarantees
you that the string in user space is still the same after the
initial strnlen_user? It might have changed before the
copy_from_user call and then we end up with an unterminated
string in the kernel. Not good.
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
--
To unsubscribe from this list: send the line "unsubscribe linux-s390" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
