On Thu, 2013-02-28 at 09:36 +0000, David Laight wrote:

quoted

  when src strlen is sizeof(ctr.name) - 1, the dest str is not '\0' end.
  better use strlcpy instead.

Signed-off-by: Chen Gang <redacted>
---
 net/rds/stats.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/rds/stats.c b/net/rds/stats.c
index 7be790d..b9ac1df 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c

@@ -86,7 +86,7 @@ void rds_stats_info_copy(struct rds_info_iterator *iter,

 	for (i = 0; i < nr; i++) {
 		BUG_ON(strlen(names[i]) >= sizeof(ctr.name));
-		strncpy(ctr.name, names[i], sizeof(ctr.name) - 1);
+		strlcpy(ctr.name, names[i], sizeof(ctr.name));
 		ctr.value = values[i];

If the target buffer ends up being copied to userspace that
might lead to random kernel memory being leaked.

Seems it is.  The last byte of 'name' is not currently initialised and
therefore is already leaked to userland.

But it's OK because rds_info_copy() uses memcpy() not __copy_to_user(),
so SMAP will block this leak. :-)

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.