-----Original Message-----
From: Wood Scott-B07421
Sent: Thursday, March 28, 2013 4:26 AM
To: Wang Dongsheng-B40534
Cc: Wood Scott-B07421; Gala Kumar-B11780; linuxppc-dev@lists.ozlabs.org;
Zhao Chenhui-B35336; Li Yang-R58472
Subject: Re: [PATCH 3/3] powerpc/fsl: add MPIC timer wakeup support
=20
On 03/26/2013 10:21:04 PM, Wang Dongsheng-B40534 wrote:

quoted

quoted

-----Original Message-----
From: Wood Scott-B07421
Sent: Wednesday, March 27, 2013 1:36 AM
To: Wang Dongsheng-B40534
Cc: Wood Scott-B07421; Gala Kumar-B11780;

linuxppc-dev@lists.ozlabs.org;

quoted

Zhao Chenhui-B35336; Li Yang-R58472
Subject: Re: [PATCH 3/3] powerpc/fsl: add MPIC timer wakeup support

On 03/25/2013 10:27:24 PM, Wang Dongsheng-B40534 wrote:

quoted

quoted

-----Original Message-----
From: Wood Scott-B07421
Sent: Saturday, March 23, 2013 6:11 AM
To: Wang Dongsheng-B40534
Cc: Wood Scott-B07421; Gala Kumar-B11780;

linuxppc-dev@lists.ozlabs.org;

quoted

Zhao Chenhui-B35336; Li Yang-R58472
Subject: Re: [PATCH 3/3] powerpc/fsl: add MPIC timer wakeup

support

quoted

quoted

quoted

On 03/22/2013 12:46:24 AM, Wang Dongsheng-B40534 wrote:

quoted

Under what case is unsafe, please make sense.

char buffer[1] =3D { '5' };
write(fd, &buffer, 1);

What comes after that '5' byte in the pointer you pass to

kstrtol?

quoted

quoted

quoted

The buffer is userspace. It will fall in the kernel space.
Kernel will get a free page, and copy the buffer to page.
This page has been cleared before copy to page.
The page has already have null-terminated.

It doesn't allocate a whole page, it uses kmalloc (not kzalloc!).

Even

quoted

if kzalloc were used, a larger user buffer could be the exact size

of the

quoted

region that was allocated.

See memdup_user() in mm/util.c

Did you miss something?
See fill_write_buffer() in fs/sysfs/file.c. It's used
get_zeroed_page()...

=20
OK, I was looking at fs/sysfs/bin.c which is something slightly different=

.

=20
fill_write_buffer() forces the size to be no more than "PAGE_SIZE - 1"
so we know there's a terminator.
=20
Perhaps kernel/rtmutex-tester.c and kernel/time/clocksource.c are
similarly confused?
=20

Yes. But its depends on file->f_op.
See vfs_write in fs/read_write.c.