tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: ashmem: use strcpy_into_buf in set_name

Browse Source 
Ashmem expected that it could always read ASHMEM_NAME_LEN bytes from the
provided pointer even if the actual string was shorter. This assumption
turns out to be false.

Bug: 409422661
Bug: 414339114
Change-Id: I7e070fc2b91f0483fd9372d52cfb4f0d6dcece48
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
This commit is contained in:
Alice Ryhl
2025-04-24 15:04:12 +00:00
committed by Isaac Manjarres
parent 6e80d044b3
commit 7f804a5b81
1 changed files with 5 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/android/ashmem_rust.rs
+5 -13
View File
@@ -297,20 +297,12 @@ impl MiscDevice for Ashmem {
}
impl Ashmem {
fn set_name(&self, mut reader: UserSliceReader) -> Result<isize> {
let mut local_name = [0u8; ASHMEM_NAME_LEN];
reader.read_slice(&mut local_name)?;
fn set_name(&self, reader: UserSliceReader) -> Result<isize> {
let mut buf = [0u8; ASHMEM_NAME_LEN];
let name = reader.strcpy_into_buf(&mut buf)?.as_bytes();
// Find the zero terminator. If the zero terminator is missing, the string is truncated to
// `ASHMEM_NAME_LEN-1` so that `get_name` can return it and has enough space to add a zero
// terminator.
let len = local_name
.iter()
.position(|&c| c == 0)
.unwrap_or(local_name.len() - 1);
let mut v = KVec::with_capacity(len, GFP_KERNEL)?;
v.extend_from_slice(&local_name[..len], GFP_KERNEL)?;
let mut v = KVec::with_capacity(name.len(), GFP_KERNEL)?;
v.extend_from_slice(name, GFP_KERNEL)?;
let mut asma = self.inner.lock();
if asma.file.is_some() {