From 7f804a5b81b5f61841abaf11d2af99b692aa977d Mon Sep 17 00:00:00 2001 From: Alice Ryhl Date: Thu, 24 Apr 2025 15:04:12 +0000 Subject: [PATCH] ANDROID: ashmem: use strcpy_into_buf in set_name Ashmem expected that it could always read ASHMEM_NAME_LEN bytes from the provided pointer even if the actual string was shorter. This assumption turns out to be false. Bug: 409422661 Bug: 414339114 Change-Id: I7e070fc2b91f0483fd9372d52cfb4f0d6dcece48 Signed-off-by: Alice Ryhl --- drivers/staging/android/ashmem_rust.rs | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/drivers/staging/android/ashmem_rust.rs b/drivers/staging/android/ashmem_rust.rs index e9238d5b87fe..8a1105f74c9d 100644 --- a/drivers/staging/android/ashmem_rust.rs +++ b/drivers/staging/android/ashmem_rust.rs @@ -297,20 +297,12 @@ impl MiscDevice for Ashmem { } impl Ashmem { - fn set_name(&self, mut reader: UserSliceReader) -> Result { - let mut local_name = [0u8; ASHMEM_NAME_LEN]; - reader.read_slice(&mut local_name)?; + fn set_name(&self, reader: UserSliceReader) -> Result { + let mut buf = [0u8; ASHMEM_NAME_LEN]; + let name = reader.strcpy_into_buf(&mut buf)?.as_bytes(); - // Find the zero terminator. If the zero terminator is missing, the string is truncated to - // `ASHMEM_NAME_LEN-1` so that `get_name` can return it and has enough space to add a zero - // terminator. - let len = local_name - .iter() - .position(|&c| c == 0) - .unwrap_or(local_name.len() - 1); - - let mut v = KVec::with_capacity(len, GFP_KERNEL)?; - v.extend_from_slice(&local_name[..len], GFP_KERNEL)?; + let mut v = KVec::with_capacity(name.len(), GFP_KERNEL)?; + v.extend_from_slice(name, GFP_KERNEL)?; let mut asma = self.inner.lock(); if asma.file.is_some() {