From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753515AbbIAGiY (ORCPT <rfc822;w@1wt.eu>);
	Tue, 1 Sep 2015 02:38:24 -0400
Received: from mga02.intel.com ([134.134.136.20]:12769 "EHLO mga02.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1752712AbbIAGiU (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Tue, 1 Sep 2015 02:38:20 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.17,447,1437462000"; 
   d="scan'208";a="795211600"
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
To: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>, Ingo Molnar <mingo@redhat.com>,
        "linux-kernel\@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Adrian Hunter <adrian.hunter@intel.com>,
        Arnaldo Carvalho de Melo <acme@infradead.org>,
        Vince Weaver <vince@deater.net>, Stephane Eranian <eranian@google.com>,
        Johannes Berg <johannes@sipsolutions.net>
Subject: Re: [PATCH v2 1/6] perf: Introduce extended syscall error reporting
In-Reply-To: <CAHp75VfEo644UcOr2YWS3usBBOtxGVciaL4j8fjtomk69x=+3g@mail.gmail.com>
References: <1440426780-27227-1-git-send-email-alexander.shishkin@linux.intel.com> <1440426780-27227-2-git-send-email-alexander.shishkin@linux.intel.com> <CAHp75VfEo644UcOr2YWS3usBBOtxGVciaL4j8fjtomk69x=+3g@mail.gmail.com>
User-Agent: Notmuch/0.20.2 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu)
Date: Tue, 01 Sep 2015 09:38:13 +0300
Message-ID: <87vbbu63vu.fsf@ashishki-desk.ger.corp.intel.com>
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Andy Shevchenko <andy.shevchenko@gmail.com> writes:

> On Mon, Aug 24, 2015 at 5:32 PM, Alexander Shishkin
> <alexander.shishkin@linux.intel.com> wrote:
>> +       /* trim the buffer to the supplied boundary */
>> +       len = strlen(buffer);
>> +       if (len >= attr->perf_err_size) {
>> +               len = attr->perf_err_size - 1;
>> +               buffer[len] = 0;
>> +       }
>
> len = strnlen(buffer, attr->perf_err_size);
> buffer[len] = 0;
>
> And perhaps perf_err_size has to be length (perf_err_len) ?
>
>> +
>> +       if (copy_to_user((void __user *)attr->perf_err, buffer, len + 1)) {
>> +               /* if we failed to copy once, don't bother later */
>> +               attr->perf_err_size = 0;
>
> Kaboom next time on buffer[-1] = 0; since len >= 0?

Of course, we never get here if attr::perf_err_size is 0, there's an
explicit check for that, but nice try.

Regards,
--
Alex