MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-06 17:35:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ANDROID: rust: uaccess: fix length usage in read_all

Browse Source 
The `read_raw` call changes the value of `self.length` to zero, so the
last call to `set_len` did not actually change the length.

Android on cuttlefish will still boot even with this bug, which is why I
didn't discover it before now.

Bug: 326198426
Link: https://lore.kernel.org/all/CAH5fLgj--WrkLJLG69P59mxBjZvMqTMHjVCcbk3Q4z7ZFTeTRQ@mail.gmail.com/
Change-Id: I1ae8e1ee12ad81a99512767bee2b9093a19450a1
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
This commit is contained in:
Alice Ryhl 2024-02-21 11:50:51 +00:00
parent e49421f9a1
commit 87f0a459c0
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rust/kernel/uaccess.rs
View File

@ -285,15 +285,16 @@ impl UserSliceReader {
/// ///
/// Fails with `EFAULT` if the read encounters a page fault. /// Fails with `EFAULT` if the read encounters a page fault.
pub fn read_all(mut self, buf: &mut Vec<u8>) -> Result<()> { pub fn read_all(mut self, buf: &mut Vec<u8>) -> Result<()> {
buf.try_reserve(self.length)?; let len = self.length;
buf.try_reserve(len)?;
// SAFETY: The call to `try_reserve` was successful, so the spare // SAFETY: The call to `try_reserve` was successful, so the spare
// capacity is at least `self.length` bytes long. // capacity is at least `self.length` bytes long.
unsafe { self.read_raw(buf.spare_capacity_mut().as_mut_ptr().cast(), self.length)? }; unsafe { self.read_raw(buf.spare_capacity_mut().as_mut_ptr().cast(), len)? };
// SAFETY: Since the call to `read_raw` was successful, so the next // SAFETY: Since the call to `read_raw` was successful, so the next
// `len` bytes of the vector have been initialized. // `len` bytes of the vector have been initialized.
unsafe { buf.set_len(buf.len() + self.length) }; unsafe { buf.set_len(buf.len() + len) };
Ok(()) Ok(())
} }
} }