* [PATCH] xfs: replace deprecated strncpy with strscpy_pad
@ 2024-04-05 19:52 Justin Stitt
2024-04-09 16:22 ` Kees Cook
0 siblings, 1 reply; 5+ messages in thread
From: Justin Stitt @ 2024-04-05 19:52 UTC (permalink / raw
To: Chandan Babu R, Darrick J. Wong
Cc: linux-xfs, linux-kernel, linux-hardening, Justin Stitt
strncpy() is deprecated for use on NUL-terminated destination strings
[1] and as such we should prefer more robust and less ambiguous string
interfaces.
The current code has taken care of NUL-termination by memset()'ing
@label. This is followed by a strncpy() to perform the string copy.
Instead, use strscpy_pad() to get both 1) NUL-termination and 2)
NUL-padding which is needed as this is copied out to userspace.
Note that this patch uses the new 2-argument version of strscpy_pad
introduced in Commit e6584c3964f2f ("string: Allow 2-argument
strscpy()").
Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2]
Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Justin Stitt <justinstitt@google.com>
---
Split from https://lore.kernel.org/all/20240401-strncpy-fs-xfs-xfs_ioctl-c-v1-1-02b9feb1989b@google.com/
with feedback from Christoph H.
---
fs/xfs/xfs_ioctl.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index d0e2cec6210d..a1156a8b1e15 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1750,15 +1750,14 @@ xfs_ioc_getlabel(
char __user *user_label)
{
struct xfs_sb *sbp = &mp->m_sb;
+ /* 1 larger than sb_fname, for a trailing NUL char */
char label[XFSLABEL_MAX + 1];
/* Paranoia */
BUILD_BUG_ON(sizeof(sbp->sb_fname) > FSLABEL_MAX);
- /* 1 larger than sb_fname, so this ensures a trailing NUL char */
- memset(label, 0, sizeof(label));
spin_lock(&mp->m_sb_lock);
- strncpy(label, sbp->sb_fname, XFSLABEL_MAX);
+ strscpy_pad(label, sbp->sb_fname);
spin_unlock(&mp->m_sb_lock);
if (copy_to_user(user_label, label, sizeof(label)))
---
base-commit: c85af715cac0a951eea97393378e84bb49384734
change-id: 20240405-strncpy-xfs-split1-a2c408b934c6
Best regards,
--
Justin Stitt <justinstitt@google.com>
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: replace deprecated strncpy with strscpy_pad
2024-04-05 19:52 [PATCH] xfs: replace deprecated strncpy with strscpy_pad Justin Stitt
@ 2024-04-09 16:22 ` Kees Cook
2024-04-10 20:45 ` Justin Stitt
0 siblings, 1 reply; 5+ messages in thread
From: Kees Cook @ 2024-04-09 16:22 UTC (permalink / raw
To: Justin Stitt
Cc: Chandan Babu R, Darrick J. Wong, linux-xfs, linux-kernel,
linux-hardening
On Fri, Apr 05, 2024 at 07:52:27PM +0000, Justin Stitt wrote:
> strncpy() is deprecated for use on NUL-terminated destination strings
> [1] and as such we should prefer more robust and less ambiguous string
> interfaces.
>
> The current code has taken care of NUL-termination by memset()'ing
> @label. This is followed by a strncpy() to perform the string copy.
>
> Instead, use strscpy_pad() to get both 1) NUL-termination and 2)
> NUL-padding which is needed as this is copied out to userspace.
>
> Note that this patch uses the new 2-argument version of strscpy_pad
> introduced in Commit e6584c3964f2f ("string: Allow 2-argument
> strscpy()").
>
> Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
> Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2]
> Link: https://github.com/KSPP/linux/issues/90
> Cc: linux-hardening@vger.kernel.org
>
> Signed-off-by: Justin Stitt <justinstitt@google.com>
> ---
> Split from https://lore.kernel.org/all/20240401-strncpy-fs-xfs-xfs_ioctl-c-v1-1-02b9feb1989b@google.com/
> with feedback from Christoph H.
> ---
> fs/xfs/xfs_ioctl.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> index d0e2cec6210d..a1156a8b1e15 100644
> --- a/fs/xfs/xfs_ioctl.c
> +++ b/fs/xfs/xfs_ioctl.c
> @@ -1750,15 +1750,14 @@ xfs_ioc_getlabel(
> char __user *user_label)
> {
> struct xfs_sb *sbp = &mp->m_sb;
> + /* 1 larger than sb_fname, for a trailing NUL char */
> char label[XFSLABEL_MAX + 1];
>
> /* Paranoia */
> BUILD_BUG_ON(sizeof(sbp->sb_fname) > FSLABEL_MAX);
>
> - /* 1 larger than sb_fname, so this ensures a trailing NUL char */
> - memset(label, 0, sizeof(label));
> spin_lock(&mp->m_sb_lock);
> - strncpy(label, sbp->sb_fname, XFSLABEL_MAX);
> + strscpy_pad(label, sbp->sb_fname);
Is sbp->sb_fname itself NUL-terminated? This looks like another case of
needing the memtostr() helper?
-Kees
> spin_unlock(&mp->m_sb_lock);
>
> if (copy_to_user(user_label, label, sizeof(label)))
>
> ---
> base-commit: c85af715cac0a951eea97393378e84bb49384734
> change-id: 20240405-strncpy-xfs-split1-a2c408b934c6
>
> Best regards,
> --
> Justin Stitt <justinstitt@google.com>
>
>
--
Kees Cook
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: replace deprecated strncpy with strscpy_pad
2024-04-09 16:22 ` Kees Cook
@ 2024-04-10 20:45 ` Justin Stitt
2024-04-11 15:31 ` Kees Cook
0 siblings, 1 reply; 5+ messages in thread
From: Justin Stitt @ 2024-04-10 20:45 UTC (permalink / raw
To: Kees Cook
Cc: Chandan Babu R, Darrick J. Wong, linux-xfs, linux-kernel,
linux-hardening
On Tue, Apr 9, 2024 at 9:22 AM Kees Cook <keescook@chromium.org> wrote:
> >
> > - /* 1 larger than sb_fname, so this ensures a trailing NUL char */
> > - memset(label, 0, sizeof(label));
> > spin_lock(&mp->m_sb_lock);
> > - strncpy(label, sbp->sb_fname, XFSLABEL_MAX);
> > + strscpy_pad(label, sbp->sb_fname);
>
> Is sbp->sb_fname itself NUL-terminated? This looks like another case of
> needing the memtostr() helper?
>
I sent a patch [1].
Obviously it depends on your implementation patch landing first; what
tree should it go to?
> Kees Cook
[1]: https://lore.kernel.org/r/20240410-strncpy-xfs-split1-v2-1-7c651502bcb0@google.com
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: replace deprecated strncpy with strscpy_pad
2024-04-10 20:45 ` Justin Stitt
@ 2024-04-11 15:31 ` Kees Cook
2024-04-15 11:22 ` David Laight
0 siblings, 1 reply; 5+ messages in thread
From: Kees Cook @ 2024-04-11 15:31 UTC (permalink / raw
To: Justin Stitt
Cc: Chandan Babu R, Darrick J. Wong, linux-xfs, linux-kernel,
linux-hardening
On Wed, Apr 10, 2024 at 01:45:21PM -0700, Justin Stitt wrote:
> On Tue, Apr 9, 2024 at 9:22 AM Kees Cook <keescook@chromium.org> wrote:
> > >
> > > - /* 1 larger than sb_fname, so this ensures a trailing NUL char */
> > > - memset(label, 0, sizeof(label));
> > > spin_lock(&mp->m_sb_lock);
> > > - strncpy(label, sbp->sb_fname, XFSLABEL_MAX);
> > > + strscpy_pad(label, sbp->sb_fname);
> >
> > Is sbp->sb_fname itself NUL-terminated? This looks like another case of
> > needing the memtostr() helper?
> >
>
> I sent a patch [1].
>
> Obviously it depends on your implementation patch landing first; what
> tree should it go to?
This "flavor" of conversion may need to wait a release? There's no
urgency on the conversion, and there are plenty more to do for this
cycle. ;)
-Kees
> [1]: https://lore.kernel.org/r/20240410-strncpy-xfs-split1-v2-1-7c651502bcb0@google.com
--
Kees Cook
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: [PATCH] xfs: replace deprecated strncpy with strscpy_pad
2024-04-11 15:31 ` Kees Cook
@ 2024-04-15 11:22 ` David Laight
0 siblings, 0 replies; 5+ messages in thread
From: David Laight @ 2024-04-15 11:22 UTC (permalink / raw
To: 'Kees Cook', Justin Stitt
Cc: Chandan Babu R, Darrick J. Wong, linux-xfs@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
From: Kees Cook
> Sent: 11 April 2024 16:32
>
> On Wed, Apr 10, 2024 at 01:45:21PM -0700, Justin Stitt wrote:
> > On Tue, Apr 9, 2024 at 9:22 AM Kees Cook <keescook@chromium.org> wrote:
> > > >
> > > > - /* 1 larger than sb_fname, so this ensures a trailing NUL char */
> > > > - memset(label, 0, sizeof(label));
> > > > spin_lock(&mp->m_sb_lock);
> > > > - strncpy(label, sbp->sb_fname, XFSLABEL_MAX);
> > > > + strscpy_pad(label, sbp->sb_fname);
> > >
> > > Is sbp->sb_fname itself NUL-terminated? This looks like another case of
> > > needing the memtostr() helper?
> > >
> >
> > I sent a patch [1].
> >
> > Obviously it depends on your implementation patch landing first; what
> > tree should it go to?
>
> This "flavor" of conversion may need to wait a release? There's no
> urgency on the conversion, and there are plenty more to do for this
> cycle. ;)
In this case:
char label[sizeof (sbp->fb_fname) + 1];
memcpy(label, sbp->sb_fname, sizeof (sbp->sb_fname));
label[sizeof (sbp->fname)] = 0;
is probably the clearest code.
(it is [12] - so no point faffing with the copy.)
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-04-15 11:23 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-05 19:52 [PATCH] xfs: replace deprecated strncpy with strscpy_pad Justin Stitt
2024-04-09 16:22 ` Kees Cook
2024-04-10 20:45 ` Justin Stitt
2024-04-11 15:31 ` Kees Cook
2024-04-15 11:22 ` David Laight
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).