Unverified Commit 46d28312 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11185 kobject_uevent: Fix OOB access within zap_modalias_env() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhao Wenhui <zhaowenhui8@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5JOQM25E2B24SALUSTW6EHKBQGDP75QK/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAKPXP 
 
Link:https://gitee.com/openeuler/kernel/pulls/11185

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents bedf6008 5b3a8d85

lib/kobject_uevent.c

+16 −1
Original line number Diff line number Diff line
@@ -430,8 +430,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) 
		len = strlen(env->envp[i]) + 1;



		if (i != env->envp_idx - 1) {

			/* @env->envp[] contains pointers to @env->buf[]

			 * with @env->buflen chars, and we are removing

			 * variable MODALIAS here pointed by @env->envp[i]

			 * with length @len as shown below:

			 *

			 * 0               @env->buf[]      @env->buflen

			 * ---------------------------------------------

			 * ^             ^              ^              ^

			 * |             |->   @len   <-| target block |

			 * @env->envp[0] @env->envp[i]  @env->envp[i + 1]

			 *

			 * so the "target block" indicated above is moved

			 * backward by @len, and its right size is

			 * @env->buflen - (@env->envp[i + 1] - @env->envp[0]).

			 */

			memmove(env->envp[i], env->envp[i + 1],

				env->buflen - len);

				env->buflen - (env->envp[i + 1] - env->envp[0]));



			for (j = i; j < env->envp_idx - 1; j++)

				env->envp[j] = env->envp[j + 1] - len;