Re: [PATCH] lib: introduce strdup_from_user

[Scott Wood <scottwood@freescale.com>]

On Fri, 3 Jun 2011 22:12:37 +0300
Alexey Dobriyan <adobriyan@gmail.com> wrote:

> On Fri, Jun 3, 2011 at 9:53 PM, Scott Wood <scottwood@freescale.com> wrote:
> > On Fri, 3 Jun 2011 21:39:28 +0300
> > Alexey Dobriyan <adobriyan@gmail.com> wrote:
> >
> >> On Fri, Jun 3, 2011 at 9:34 PM, Timur Tabi <timur@freescale.com> wrote:
> >> > Would it be better if I did this:
> >>
> >> The point is data should cross kernelspace/userspace boundary only once.
> >>
> >
> > Why does it matter, as long as it doesn't hurt the kernel if userspace
> > plays games (i.e. take care of the NUL termination), and it's not a
> > performance problem?
> 
> Because now you're lucky C strings are NUL-terminated.
> If this "idiom" applies to some other case like "validate + copy",
> we have a bug.

It's not an idiom.  It is a simple solution to this particular problem.

> We copy data to kernelspace THEN validate or copy or whatever.
> This is obviously correct and safe.

That doesn't mean that other things are necessarily incorrect or unsafe.
The first access is not validation in this case.

In any case, as it appears there's already a strndup_user() in the kernel,
we'll just use that.  You can "fix" it to do a single userspace access, if
you'd like. :-)

-Scott