| Message ID | 5195F4A0.3000708@asianux.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Chen Gang <gang.chen@asianux.com> Date: Fri, 17 May 2013 17:13:04 +0800 > > 'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the > strncpy() will always left the last byte of 'discovery->data.info' > uninitialized. > > When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left > the last byte of 'discovery->data.info' uninitialized, the next > strlen() will cause issue. > > Also 'discovery->data' is 'struct irda_device_info' which defined in > "include/uapi/...", it may copy to user mode, so need whole initialized. > > All together, need use kzalloc() instead of kmalloc() to initialize all > members firstly. > > Signed-off-by: Chen Gang <gang.chen@asianux.com> Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 05/20/2013 06:11 AM, David Miller wrote: > From: Chen Gang <gang.chen@asianux.com> > Date: Fri, 17 May 2013 17:13:04 +0800 > >> > >> > 'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the >> > strncpy() will always left the last byte of 'discovery->data.info' >> > uninitialized. >> > >> > When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left >> > the last byte of 'discovery->data.info' uninitialized, the next >> > strlen() will cause issue. >> > >> > Also 'discovery->data' is 'struct irda_device_info' which defined in >> > "include/uapi/...", it may copy to user mode, so need whole initialized. >> > >> > All together, need use kzalloc() instead of kmalloc() to initialize all >> > members firstly. >> > >> > Signed-off-by: Chen Gang <gang.chen@asianux.com> > Applied, thanks. > > Thank you, too. Thanks.
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c index 8c00416..9ea0c93 100644 --- a/net/irda/irlap_frame.c +++ b/net/irda/irlap_frame.c @@ -544,7 +544,7 @@ static void irlap_recv_discovery_xid_cmd(struct irlap_cb *self, /* * We now have some discovery info to deliver! */ - discovery = kmalloc(sizeof(discovery_t), GFP_ATOMIC); + discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC); if (!discovery) { IRDA_WARNING("%s: unable to malloc!\n", __func__); return;
'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the strncpy() will always left the last byte of 'discovery->data.info' uninitialized. When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left the last byte of 'discovery->data.info' uninitialized, the next strlen() will cause issue. Also 'discovery->data' is 'struct irda_device_info' which defined in "include/uapi/...", it may copy to user mode, so need whole initialized. All together, need use kzalloc() instead of kmalloc() to initialize all members firstly. Signed-off-by: Chen Gang <gang.chen@asianux.com> --- net/irda/irlap_frame.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)