Messages in this thread | | | From | Arnd Bergmann <> | Date | Tue, 14 Jul 2020 11:01:35 +0200 | Subject | Re: [PATCH 1/1] misc: c2port: core: Make copying name from userspace more secure |
| |
On Tue, Jul 14, 2020 at 10:33 AM Lee Jones <lee.jones@linaro.org> wrote: > > Currently the 'c2dev' device data is not zeroed when its allocated. > Coupled with the fact strncpy() *may not* provide a NUL terminator > means that a 1-byte leak would be possible *if* this was ever copied > to userspace. > > To prevent such a failing, let's first ensure the 'c2dev' device data > area is fully zeroed out and ensure the buffer will always be NUL > terminated by using the kernel's strscpy() which a) uses the > destination (instead of the source) size as the bytes to copy and b) > is *always* NUL terminated. > > Cc: Rodolfo Giometti <giometti@enneenne.com> > Cc: "Eurotech S.p.A" <info@eurotech.it> > Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> > Signed-off-by: Lee Jones <lee.jones@linaro.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
| |