On Sun, Aug 21, 2022 at 11:13:28AM -0700, Linus Torvalds wrote: > It's also worth pointing out that the kernel implementation of > 'strscpy()' will not do the chunk-sized accesses across an unaligned > page boundary. So it won't actually take a page fault past the > terminating NUL character, but if you pass it an 'N' that is bigger > than the source buffer, and you have sub-page faults in the kernel, we > might need to do some further work in this are. Catalin? We can probably hit sub-page faults if the function reads past the end of a string. Strange that we haven't hit any so far (well, it needs KASAN_HW_TAGS enabled, it doesn't get as much coverage). With load_unaligned_zeropad(), the arm64 implementation disables tag checking temporarily. We could do the same with read_word_at_a_time() (there is a kasan_check_read() in this function but it wrongly uses a size of 1). I'll send a patch but most likely next week (I'm still on holiday). -- Catalin
