Patch "string: Adjust strtomem() logic to allow for smaller sources" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    string: Adjust strtomem() logic to allow for smaller sources

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     string-adjust-strtomem-logic-to-allow-for-smaller-so.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1e1653bd8ab0abcb72b1d01e6a1a5ee3b3685ce0
Author: Kees Cook <keescook@xxxxxxxxxxxx>
Date:   Wed Oct 18 10:53:58 2023 -0700

    string: Adjust strtomem() logic to allow for smaller sources
    
    [ Upstream commit 0e108725f6cc5b3be9e607f89c9fbcbb236367b7 ]
    
    Arnd noticed we have a case where a shorter source string is being copied
    into a destination byte array, but this results in a strnlen() call that
    exceeds the size of the source. This is seen with -Wstringop-overread:
    
    In file included from ../include/linux/uuid.h:11,
                     from ../include/linux/mod_devicetable.h:14,
                     from ../include/linux/cpufeature.h:12,
                     from ../arch/x86/coco/tdx/tdx.c:7:
    ../arch/x86/coco/tdx/tdx.c: In function 'tdx_panic.constprop':
    ../include/linux/string.h:284:9: error: 'strnlen' specified bound 64 exceeds source size 60 [-Werror=stringop-overread]
      284 |         memcpy_and_pad(dest, _dest_len, src, strnlen(src, _dest_len), pad); \
          |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ../arch/x86/coco/tdx/tdx.c:124:9: note: in expansion of macro 'strtomem_pad'
      124 |         strtomem_pad(message.str, msg, '\0');
          |         ^~~~~~~~~~~~
    
    Use the smaller of the two buffer sizes when calling strnlen(). When
    src length is unknown (SIZE_MAX), it is adjusted to use dest length,
    which is what the original code did.
    
    Reported-by: Arnd Bergmann <arnd@xxxxxxxx>
    Fixes: dfbafa70bde2 ("string: Introduce strtomem() and strtomem_pad()")
    Tested-by: Arnd Bergmann <arnd@xxxxxxxx>
    Cc: Andy Shevchenko <andy@xxxxxxxxxx>
    Cc: linux-hardening@xxxxxxxxxxxxxxx
    Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/linux/string.h b/include/linux/string.h
index cf7607b321027..26ab8928d8661 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -276,10 +276,12 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
  */
 #define strtomem_pad(dest, src, pad)	do {				\
 	const size_t _dest_len = __builtin_object_size(dest, 1);	\
+	const size_t _src_len = __builtin_object_size(src, 1);		\
 									\
 	BUILD_BUG_ON(!__builtin_constant_p(_dest_len) ||		\
 		     _dest_len == (size_t)-1);				\
-	memcpy_and_pad(dest, _dest_len, src, strnlen(src, _dest_len), pad); \
+	memcpy_and_pad(dest, _dest_len, src,				\
+		       strnlen(src, min(_src_len, _dest_len)), pad);	\
 } while (0)
 
 /**
@@ -297,10 +299,11 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
  */
 #define strtomem(dest, src)	do {					\
 	const size_t _dest_len = __builtin_object_size(dest, 1);	\
+	const size_t _src_len = __builtin_object_size(src, 1);		\
 									\
 	BUILD_BUG_ON(!__builtin_constant_p(_dest_len) ||		\
 		     _dest_len == (size_t)-1);				\
-	memcpy(dest, src, min(_dest_len, strnlen(src, _dest_len)));	\
+	memcpy(dest, src, strnlen(src, min(_src_len, _dest_len)));	\
 } while (0)
 
 /**



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux