Re: [PATCH 5.8 regression fix] platform/x86: thinkpad_acpi: Revert: Use strndup_user() in dispatch_proc_write()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jul 14, 2020 at 11:21 AM Andy Shevchenko
<andy.shevchenko@xxxxxxxxx> wrote:
> On Tue, Jul 14, 2020 at 11:15 AM Hans de Goede <hdegoede@xxxxxxxxxx> wrote:
> >
> > Commit 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user()
> > in dispatch_proc_write()") cleaned up dispatch_proc_write() by replacing
> > the code to copy the passed in data from userspae with strndup_user().
>
> user space
>
> > But strndup_user() expects a 0 terminated input buffer and the buffer
> > passed to dispatch_proc_write() is NOT 0 terminated.

Second though, perhaps it's a simple wrong count parameter?
strndup_user(..., min(count, PAGE_SIZE)) or so would work?

> > So this change leads to strndup_user() copying some extra random bytes
> > from userspace till it hits a 0 byte.
> >
> > This commit reverts the change to use strndup_user() fixing the
> > buffer being passed to the ibm_struct.write() call back containing extra
> > junk at the end.
>
> Can we simply use memdup_user()?
> And thanks for catching this up!



-- 
With Best Regards,
Andy Shevchenko



[Index of Archives]     [Linux Kernel Development]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux