Messages in this thread | | | Date | Wed, 10 Nov 2021 10:37:03 +0300 | Subject | Re: [PATCH] tty: vt: keyboard: do not copy an extra-byte in copy_to_user | From | Pavel Skripkin <> |
| |
On 11/10/21 08:22, Jiri Slaby wrote: > I don't quite understand what the problem is. Provided I wrote the code, > is there something wrong with this commit (and its explanation), in > particular? > > commit 6ca03f90527e499dd5e32d6522909e2ad390896b > Author: Jiri Slaby <jirislaby@kernel.org> > Date: Mon Oct 19 10:55:16 2020 +0200 > > vt: keyboard, simplify vt_kdgkbsent > > Use 'strlen' of the string, add one for NUL terminator and simply do > 'copy_to_user' instead of the explicit 'for' loop. This makes the > KDGKBSENT case more compact. > > The only thing we need to take care about is NULL 'func_table[i]'. Use > an empty string in that case. > > The original check for overflow could never trigger as the func_buf > strings are always shorter or equal to 'struct kbsentry's. > > thanks, >
As I said in my few previous emails, I don't see any bugs/problems in current code.
Ajay wants to be safe and he thinks, that relying on fact, that strlen(func_table[kb_func]) < sizeof(user_kdgkb->kb_string) is not good approach, since it's external for vt_do_kdgkb_ioctl. (I hope, I've explained his idea in the right way)
With regards, Pavel Skripkin
| |