Messages in this thread | | | Date | 11 Jun 2004 23:49:01 -0000 | From | linux@horizon ... | Subject | Re: [PATCH] s390: speedup strn{cpy,len}_from_user. |
| |
>> static inline long >> strncpy_from_user(char *dst, const char *src, long count) >> { >> long res = -EFAULT; >> might_sleep(); >> - if (access_ok(VERIFY_READ, src, 1)) >> - res = __strncpy_from_user_asm(dst, src, count); >> + if (access_ok(VERIFY_READ, src, 1)) { >> + res = __strncpy_from_user_asm(count, dst, src); >> + } >> return res; >> }
> Shouldn't the access_ok() check be passed `count', rather than `1'?
This deserves a comment, but no.
"count" is the maximum length of the string, not the actual length. If you passed it to access_ok(), you'd falsely EFAULT a short string near the end of the address space.
Assuming that there's a guard page at the end of the user address space, __strncpy_from_user_asm is guaranteed to hit it as part of normal operations, and will get the fault. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |