summaryrefslogtreecommitdiff
path: root/net/unix
diff options
context:
space:
mode:
authorPetr Mladek <pmladek@suse.com>2025-07-02 11:51:57 +0200
committerPetr Mladek <pmladek@suse.com>2025-07-10 17:12:21 +0200
commitd18d7989e3da1f2753d49cb24d916f357e340f76 (patch)
tree9b59d8b6b99d8322ad595a5274733a3c17636472 /net/unix
parent254e8fb5e67643a19a8dd6e142262ec83b30c3c7 (diff)
printk: kunit: Fix __counted_by() in struct prbtest_rbdata
__counted_by() has to point to a variable which defines the size of the related array. The code must never access the array beyond this limit. struct prbtest_rbdata currently stores the length of the string. And the code access the array beyond the limit when writing or reading the trailing '\0'. Store the size of the string, including the trailing '\0' if we wanted to keep __counted_by(). Consistently use "_size" suffix when the trailing '\0' is counted. Note that MAX_RBDATA_TEXT_SIZE was originally used to limit the text length. When touching the code, make sure that @text_size produced by get_random_u32_inclusive() stays within the limits. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/eaea66b9-266a-46e7-980d-33f40ad4b215@sabinyo.mountain Suggested-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Reviewed-by: John Ogness <john.ogness@linutronix.de> Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20250702095157.110916-4-pmladek@suse.com Signed-off-by: Petr Mladek <pmladek@suse.com>
Diffstat (limited to 'net/unix')
0 files changed, 0 insertions, 0 deletions