This is a note to let you know that I've just added the patch titled lib/strscpy: Shut up KASAN false-positives in strscpy() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: lib-strscpy-shut-up-kasan-false-positives-in-strscpy.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Oct 22 03:56:50 PM CEST 2020 From: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx> Date: Thu, 1 Feb 2018 21:00:50 +0300 Subject: lib/strscpy: Shut up KASAN false-positives in strscpy() From: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx> commit 1a3241ff10d038ecd096d03380327f2a0b5840a6 upstream. strscpy() performs the word-at-a-time optimistic reads. So it may may access the memory past the end of the object, which is perfectly fine since strscpy() doesn't use that (past-the-end) data and makes sure the optimistic read won't cross a page boundary. Use new read_word_at_a_time() to shut up the KASAN. Note that this potentially could hide some bugs. In example bellow, stscpy() will copy more than we should (1-3 extra uninitialized bytes): char dst[8]; char *src; src = kmalloc(5, GFP_KERNEL); memset(src, 0xff, 5); strscpy(dst, src, 8); Signed-off-by: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Ben Hutchings <ben.hutchings@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- lib/string.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/lib/string.c +++ b/lib/string.c @@ -202,7 +202,7 @@ ssize_t strscpy(char *dest, const char * while (max >= sizeof(unsigned long)) { unsigned long c, data; - c = *(unsigned long *)(src+res); + c = read_word_at_a_time(src+res); if (has_zero(c, &data, &constants)) { data = prep_zero_mask(c, data, &constants); data = create_zero_mask(data); Patches currently in stable-queue which might be from aryabinin@xxxxxxxxxxxxx are queue-4.4/x86-mm-ptdump-fix-soft-lockup-in-page-table-walker.patch queue-4.4/mm-kasan-add-api-to-check-memory-regions.patch queue-4.4/compiler.h-add-read_word_at_a_time-function.patch queue-4.4/compiler.h-kasan-avoid-duplicating-__read_once_size_nocheck.patch queue-4.4/mm-kasan-print-name-of-mem-caller-in-report.patch queue-4.4/lib-strscpy-shut-up-kasan-false-positives-in-strscpy.patch