]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
lib: Fix strnlen_user() to not touch memory after specified maximum
authorJan Kara <jack@suse.cz>
Tue, 2 Jun 2015 15:10:28 +0000 (17:10 +0200)
committerSasha Levin <sasha.levin@oracle.com>
Tue, 9 Jun 2015 18:31:43 +0000 (14:31 -0400)
commitbfad74288efce9d33b26ea2a694406d4e0727a20
treebbe35b8d1c1e5202c412333df9e4d7553715a5da
parentab673124ce097c0eb9a9e6691ebd41eb0d0225ba
lib: Fix strnlen_user() to not touch memory after specified maximum

[ Upstream commit f18c34e483ff6b1d9866472221e4015b3a4698e4 ]

If the specified maximum length of the string is a multiple of unsigned
long, we would load one long behind the specified maximum.  If that
happens to be in a next page, we can hit a page fault although we were
not expected to.

Fix the off-by-one bug in the test whether we are at the end of the
specified range.

Signed-off-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
lib/strnlen_user.c