Unverified Commit 7e747d5c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1238 [sync] PR-1181: relayfs: fix out-of-bounds access in relay_file_read 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1181 
 
PR sync from: "GONG, Ruiqi" <gongruiqi1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/2UQWQFUDJJ3AA4KWKXEAZSYYXWTLW3UM/ 
 
 
Link:https://gitee.com/openeuler/kernel/pulls/1238

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 62acc033 399b246a

kernel/relay.c

+2 −1
Original line number Diff line number Diff line
@@ -1077,7 +1077,8 @@ static size_t relay_file_read_start_pos(struct rchan_buf *buf) 
	size_t subbuf_size = buf->chan->subbuf_size;

	size_t n_subbufs = buf->chan->n_subbufs;

	size_t consumed = buf->subbufs_consumed % n_subbufs;

	size_t read_pos = consumed * subbuf_size + buf->bytes_consumed;

	size_t read_pos = (consumed * subbuf_size + buf->bytes_consumed)

			% (n_subbufs * subbuf_size);



	read_subbuf = read_pos / subbuf_size;

	padding = buf->padding[read_subbuf];