linux/lib/strnlen_user.c
Jan Kara 9ad68dc3f6 lib: Fix strnlen_user() to not touch memory after specified maximum
commit f18c34e483 upstream.

If the specified maximum length of the string is a multiple of unsigned
long, we would load one long behind the specified maximum.  If that
happens to be in a next page, we can hit a page fault although we were
not expected to.

Fix the off-by-one bug in the test whether we are at the end of the
specified range.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-06-06 08:19:32 -07:00

139 lines
3.7 KiB