Messages in this thread | | | From | Andy Shevchenko <> | Date | Tue, 14 Jul 2020 11:27:43 +0300 | Subject | Re: [PATCH 5.8 regression fix] platform/x86: thinkpad_acpi: Revert: Use strndup_user() in dispatch_proc_write() |
| |
On Tue, Jul 14, 2020 at 11:21 AM Andy Shevchenko <andy.shevchenko@gmail.com> wrote: > On Tue, Jul 14, 2020 at 11:15 AM Hans de Goede <hdegoede@redhat.com> wrote: > > > > Commit 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() > > in dispatch_proc_write()") cleaned up dispatch_proc_write() by replacing > > the code to copy the passed in data from userspae with strndup_user(). > > user space > > > But strndup_user() expects a 0 terminated input buffer and the buffer > > passed to dispatch_proc_write() is NOT 0 terminated.
Second though, perhaps it's a simple wrong count parameter? strndup_user(..., min(count, PAGE_SIZE)) or so would work?
> > So this change leads to strndup_user() copying some extra random bytes > > from userspace till it hits a 0 byte. > > > > This commit reverts the change to use strndup_user() fixing the > > buffer being passed to the ibm_struct.write() call back containing extra > > junk at the end. > > Can we simply use memdup_user()? > And thanks for catching this up!
-- With Best Regards, Andy Shevchenko
| |