From: Manuel Schölling <hidden> Date: 2014-06-07 17:57:03
dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
---
net/dns_resolver/dns_query.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
On Sat, Jun 7, 2014 at 1:56 PM, Manuel Schölling
[off-list ref] wrote:
quoted hunk
dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
---
net/dns_resolver/dns_query.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
+
if (_expiry)
*_expiry = rkey->expiry;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
--
Trond Myklebust
Linux NFS client maintainer, PrimaryData
trond.myklebust@primarydata.com
From: Manuel Schoelling <hidden> Date: 2014-06-07 18:57:45
LOL, that was stupid!
Sorry, I'll send a corrected version in a second...
On Sa, 2014-06-07 at 14:54 -0400, Trond Myklebust wrote:
On Sat, Jun 7, 2014 at 1:56 PM, Manuel Schölling
[off-list ref] wrote:
quoted
dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
---
net/dns_resolver/dns_query.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
+
if (_expiry)
*_expiry = rkey->expiry;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Manuel Schölling <hidden> Date: 2014-06-07 19:01:31
dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
---
net/dns_resolver/dns_query.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
kzalloc() would be unnecessary overhead (zeroing definitely comes with a
cost) if you're going to copy to the memory immediately afterwards. Just
leave the kmalloc(), do the memcpy() and explicitly zero terminate it
_result.
kzalloc() would be unnecessary overhead (zeroing definitely comes with a
cost) if you're going to copy to the memory immediately afterwards. Just
leave the kmalloc(), do the memcpy() and explicitly zero terminate it
_result.
Using kzalloc() was suggested of a developer on IRC (#kernelnewbies) but
if you prefer kmalloc, that's ok, too.
I'll send you a corrected patch in a second.
From: Manuel Schölling <hidden> Date: 2014-06-07 21:58:12
dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
Signed-off-by: Manuel Schölling <redacted>
---
net/dns_resolver/dns_query.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
kzalloc() would be unnecessary overhead (zeroing definitely comes with a
cost) if you're going to copy to the memory immediately afterwards. Just
leave the kmalloc(), do the memcpy() and explicitly zero terminate it
_result.
You can also replace kmalloc()/memcpy() with kmemdup().
WBR, Sergei
From: David Rientjes <rientjes@google.com> Date: 2014-06-07 22:02:42
On Sat, 7 Jun 2014, Manuel Schoelling wrote:
quoted
kzalloc() would be unnecessary overhead (zeroing definitely comes with a
cost) if you're going to copy to the memory immediately afterwards. Just
leave the kmalloc(), do the memcpy() and explicitly zero terminate it
_result.
Using kzalloc() was suggested of a developer on IRC (#kernelnewbies) but
if you prefer kmalloc, that's ok, too.
I'll send you a corrected patch in a second.
Using kzalloc() here instead of kmalloc() is functionally equivalent to
if (*_result) {
memset(*_result, 0, len + 1);
memcpy(*_result, upayload->data, len);
}
so for anything with len > 1 there is an unnecessary overhead in doing
this. k?alloc() can return object sizes larger than len + 1 here as well
(usually power-of-2 sizes are supported by the slab allocator) so
depending on the value of len, you may be zeroing more memory than
copying.
Your first patch had the right idea, it's just off by one.
From: David Miller <davem@davemloft.net> Date: 2014-06-11 07:12:19
From: Manuel Schölling <redacted>
Date: Sat, 7 Jun 2014 23:57:25 +0200
dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
Signed-off-by: Manuel Schölling <redacted>