On Tue, Sep 19, 2023 at 07:21:56PM +0000, Azeem Shaikh wrote: > strlcpy() reads the entire source buffer first and returns the size of > the source string, not the destination string, which can be accidentally > misused [1]. > > The copy_to_user() call uses @len returned from strlcpy() directly > without checking its value. This could potentially lead to read > overflow. There is no existing bug since @len is always guaranteed to be > greater than hardcoded strings in @func_table[kb_func]. But as written > it is very fragile and specifically uses a strlcpy() result without sanity > checking and using it to copy to userspace. > > In an effort to remove strlcpy() completely [2], replace > strlcpy() here with strscpy(). > > [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy > [2] https://github.com/KSPP/linux/issues/89 > > Signed-off-by: Azeem Shaikh <azeems@xxxxxxxxxx> > --- > v2: > * Return -ENOSPC instead of -EFAULT in case of truncation. > * Update commit log to clarify that there is no exploitable bug but instead the code uses a fragile anti-pattern. Changes look good. Thanks! Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> -- Kees Cook
