| Message ID | 20240401-strncpy-fs-proc-vmcore-c-v2-1-dd0a73f42635@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] vmcore: replace strncpy with strscpy_pad | expand |
On 04/01/24 at 06:39pm, Justin Stitt wrote: > strncpy() is in the process of being replaced as it is deprecated [1]. > We should move towards safer and less ambiguous string interfaces. > > Looking at vmcoredd_header's definition: > | struct vmcoredd_header { > | __u32 n_namesz; /* Name size */ > | __u32 n_descsz; /* Content size */ > | __u32 n_type; /* NT_VMCOREDD */ > | __u8 name[8]; /* LINUX\0\0\0 */ > | __u8 dump_name[VMCOREDD_MAX_NAME_BYTES]; /* Device dump's name */ > | }; > ... we see that @name wants to be NUL-padded. > > We're copying data->dump_name which is defined as: > | char dump_name[VMCOREDD_MAX_NAME_BYTES]; /* Unique name of the dump */ > ... which shares the same size as vdd_hdr->dump_name. Let's make sure we > NUL-pad this as well. > > Use strscpy_pad() which NUL-terminates and NUL-pads its destination > buffers. Specifically, use the new 2-argument version of strscpy_pad > introduced in Commit e6584c3964f2f ("string: Allow 2-argument > strscpy()"). > > Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] > Link: https://github.com/KSPP/linux/issues/90 > Cc: linux-hardening@vger.kernel.org > Signed-off-by: Justin Stitt <justinstitt@google.com> > --- > Changes in v2: > - don't mark buffers as __nonstring, instead use a string API (thanks Kees) > - Link to v1: https://lore.kernel.org/r/20240327-strncpy-fs-proc-vmcore-c-v1-1-e025ed08b1b0@google.com > --- > Note: build-tested only. > > Found with: $ rg "strncpy\(" > --- > fs/proc/vmcore.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c > index 1fb213f379a5..5d08d4d159d3 100644 > --- a/fs/proc/vmcore.c > +++ b/fs/proc/vmcore.c > @@ -1370,9 +1370,8 @@ static void vmcoredd_write_header(void *buf, struct vmcoredd_data *data, > vdd_hdr->n_descsz = size + sizeof(vdd_hdr->dump_name); > vdd_hdr->n_type = NT_VMCOREDD; > > - strncpy((char *)vdd_hdr->name, VMCOREDD_NOTE_NAME, > - sizeof(vdd_hdr->name)); > - memcpy(vdd_hdr->dump_name, data->dump_name, sizeof(vdd_hdr->dump_name)); > + strscpy_pad(vdd_hdr->name, VMCOREDD_NOTE_NAME); > + strscpy_pad(vdd_hdr->dump_name, data->dump_name); LGTM, thx Acked-by: Baoquan He <bhe@redhat.com>
On Mon, Apr 01, 2024 at 06:39:55PM +0000, Justin Stitt wrote: > strncpy() is in the process of being replaced as it is deprecated [1]. > We should move towards safer and less ambiguous string interfaces. > > Looking at vmcoredd_header's definition: > | struct vmcoredd_header { > | __u32 n_namesz; /* Name size */ > | __u32 n_descsz; /* Content size */ > | __u32 n_type; /* NT_VMCOREDD */ > | __u8 name[8]; /* LINUX\0\0\0 */ > | __u8 dump_name[VMCOREDD_MAX_NAME_BYTES]; /* Device dump's name */ > | }; > ... we see that @name wants to be NUL-padded. > > We're copying data->dump_name which is defined as: > | char dump_name[VMCOREDD_MAX_NAME_BYTES]; /* Unique name of the dump */ > ... which shares the same size as vdd_hdr->dump_name. Let's make sure we > NUL-pad this as well. > > Use strscpy_pad() which NUL-terminates and NUL-pads its destination > buffers. Specifically, use the new 2-argument version of strscpy_pad > introduced in Commit e6584c3964f2f ("string: Allow 2-argument > strscpy()"). > > Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] > Link: https://github.com/KSPP/linux/issues/90 > Cc: linux-hardening@vger.kernel.org > Signed-off-by: Justin Stitt <justinstitt@google.com> Looks good; thanks! Reviewed-by: Kees Cook <keescook@chromium.org>
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c index 1fb213f379a5..5d08d4d159d3 100644 --- a/fs/proc/vmcore.c +++ b/fs/proc/vmcore.c @@ -1370,9 +1370,8 @@ static void vmcoredd_write_header(void *buf, struct vmcoredd_data *data, vdd_hdr->n_descsz = size + sizeof(vdd_hdr->dump_name); vdd_hdr->n_type = NT_VMCOREDD; - strncpy((char *)vdd_hdr->name, VMCOREDD_NOTE_NAME, - sizeof(vdd_hdr->name)); - memcpy(vdd_hdr->dump_name, data->dump_name, sizeof(vdd_hdr->dump_name)); + strscpy_pad(vdd_hdr->name, VMCOREDD_NOTE_NAME); + strscpy_pad(vdd_hdr->dump_name, data->dump_name); } /**
strncpy() is in the process of being replaced as it is deprecated [1]. We should move towards safer and less ambiguous string interfaces. Looking at vmcoredd_header's definition: | struct vmcoredd_header { | __u32 n_namesz; /* Name size */ | __u32 n_descsz; /* Content size */ | __u32 n_type; /* NT_VMCOREDD */ | __u8 name[8]; /* LINUX\0\0\0 */ | __u8 dump_name[VMCOREDD_MAX_NAME_BYTES]; /* Device dump's name */ | }; ... we see that @name wants to be NUL-padded. We're copying data->dump_name which is defined as: | char dump_name[VMCOREDD_MAX_NAME_BYTES]; /* Unique name of the dump */ ... which shares the same size as vdd_hdr->dump_name. Let's make sure we NUL-pad this as well. Use strscpy_pad() which NUL-terminates and NUL-pads its destination buffers. Specifically, use the new 2-argument version of strscpy_pad introduced in Commit e6584c3964f2f ("string: Allow 2-argument strscpy()"). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt <justinstitt@google.com> --- Changes in v2: - don't mark buffers as __nonstring, instead use a string API (thanks Kees) - Link to v1: https://lore.kernel.org/r/20240327-strncpy-fs-proc-vmcore-c-v1-1-e025ed08b1b0@google.com --- Note: build-tested only. Found with: $ rg "strncpy\(" --- fs/proc/vmcore.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- base-commit: 928a87efa42302a23bb9554be081a28058495f22 change-id: 20240327-strncpy-fs-proc-vmcore-c-b18d761feaef Best regards, -- Justin Stitt <justinstitt@google.com>