lkml.org 
[lkml]   [2017]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 18/50] strscpy: zero any trailing garbage bytes in the destination
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Chris Metcalf <cmetcalf@ezchip.com>

    commit 990486c8af044f89bddfbde1d1cf9fde449bedbf upstream.

    It's possible that the destination can be shadowed in userspace
    (as, for example, the perf buffers are now). So we should take
    care not to leak data that could be inspected by userspace.

    Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    lib/string.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/lib/string.c
    +++ b/lib/string.c
    @@ -211,12 +211,13 @@ ssize_t strscpy(char *dest, const char *
    unsigned long c, data;

    c = *(unsigned long *)(src+res);
    - *(unsigned long *)(dest+res) = c;
    if (has_zero(c, &data, &constants)) {
    data = prep_zero_mask(c, data, &constants);
    data = create_zero_mask(data);
    + *(unsigned long *)(dest+res) = c & zero_bytemask(data);
    return res + find_zero(data);
    }
    + *(unsigned long *)(dest+res) = c;
    res += sizeof(unsigned long);
    count -= sizeof(unsigned long);
    max -= sizeof(unsigned long);

    \
     
     \ /
      Last update: 2017-08-05 01:31    [W:2.693 / U:0.656 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site