On Thu, 2011-09-01 at 09:30 +1000, Ryan Mallon wrote:On 01/09/11 07:26, Mark Salter wrote:Yes, one would think so, but that doesn't seem to be the case. LookingThe existing __strnlen_user macro simply resolved to strnlen. However, theI don't think this is correct because if you hit maxlen you will add one
count returned by strnlen_user should include the NULL byte. This patch
fixes the __strnlen_user macro to include the NULL byte in the count.
Signed-off-by: Mark Salter<msalter@xxxxxxxxxx>
---
include/asm-generic/uaccess.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index ac68c99..1d0fdf8 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -289,7 +289,7 @@ strncpy_from_user(char *dst, const char __user *src, long count)
* Return 0 on exception, a value greater than N if too long
*/
#ifndef __strnlen_user
-#define __strnlen_user strnlen
+#define __strnlen_user(s, n) (strnlen((s), (n)) + 1)
#endif
to it. e.g. __strnlen_user("abcd\0", 3) would return 4 instead of 3.
at various places that call strnlen_user, you'll find checks for that.
For one example, mm/util.c:
char *strndup_user(const char __user *s, long n)
{
char *p;
long length;
length = strnlen_user(s, n);
if (!length)
return ERR_PTR(-EFAULT);
if (length> n)
return ERR_PTR(-EINVAL);