Subject: Re: [PATCH 0/2] strndup_user, v2
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: Davi Arnaut <davi.arnaut@gmail.com>
Cc: torvalds@osdl.org, akpm@osdl.org, linux-kernel@vger.kernel.org
In-Reply-To: <20060215182258.03505613.davi.arnaut@gmail.com>
References: <20060215182258.03505613.davi.arnaut@gmail.com>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Date: Thu, 16 Feb 2006 01:25:56 +0000
Message-Id: <1140053156.14831.43.camel@localhost.localdomain>
Mime-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1035
Lines: 45

On Mer, 2006-02-15 at 18:22 -0300, Davi Arnaut wrote:
> +static inline char *strdup_user(const char __user *s)
> +{
> +	return strndup_user(s, 4096);
> +}

Still shouldn't exist. Its just a bad idea to give people broken
function they don't yet use.


> +	length = strlen_user(s);

Should use strnlen_user or this function is useless for most cases.

> +
> +	if (!length)
> +		return ERR_PTR(-EFAULT);

Zero isn't an -EFAULT length. Its a null string and valid
> +
> +	if (length > n)
> +		length = n;
> +
> +	p = kmalloc(length, GFP_KERNEL);
> +
> +	if (!p)
> +		return ERR_PTR(-ENOMEM);
> +
> +	if (strncpy_from_user(p, s, length) < 0) {
> +		kfree(p);
> +		return ERR_PTR(-EFAULT);
> +	}
> +
> +	p[length - 1] = '\0';

And still broken.

"Hello" -> length = 5   "Hello\0"[4] = 0 "Hell"


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/