Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

asm-generic: uaccess: add missing access_ok() check to strnlen_user()

The strnlen_user() function was missing a access_ok() check on the pointer
given. We've had cases on Blackfin systems where test programs caused
kernel crashes here because userspace passed up a NULL/-1 pointer and the
kernel gladly attempted to run strlen() on it.

Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

authored by

Mike Frysinger and committed by
Arnd Bergmann
9844813f 0732f877

+2
+2
include/asm-generic/uaccess.h
··· 291 291 #ifndef strnlen_user 292 292 static inline long strnlen_user(const char __user *src, long n) 293 293 { 294 + if (!access_ok(VERIFY_READ, src, 1)) 295 + return 0; 294 296 return strlen((void * __force)src) + 1; 295 297 } 296 298 #endif