linux/lib/strnlen_user.c
Jan Kara bfad74288e lib: Fix strnlen_user() to not touch memory after specified maximum
[ Upstream commit f18c34e483 ]

If the specified maximum length of the string is a multiple of unsigned
long, we would load one long behind the specified maximum.  If that
happens to be in a next page, we can hit a page fault although we were
not expected to.

Fix the off-by-one bug in the test whether we are at the end of the
specified range.

Signed-off-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-06-09 14:31:43 -04:00

139 lines
3.7 KiB