diff options
author | Kees Cook <[email protected]> | 2023-12-12 13:17:39 -0800 |
---|---|---|
committer | Greg Kroah-Hartman <[email protected]> | 2023-12-15 17:25:10 +0100 |
commit | 5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5 (patch) | |
tree | 8c1a0cf48db40987b64c8cbe10b76b622e34eb2b /lib/test_fortify/write_overflow-strlcpy-src.c | |
parent | 792e04768efbf2a1b49a7162a9fa06c1fa584723 (diff) |
kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()
strlcpy() reads the entire source buffer first. This read may exceed
the destination size limit. This is both inefficient and can lead
to linear read overflows if a source string is not NUL-terminated[1].
Additionally, it returns the size of the source string, not the
resulting size of the destination string. In an effort to remove strlcpy()
completely[2], replace strlcpy() here with strscpy().
Nothing actually checks the return value coming from kernfs_name_locked(),
so this has no impact on error paths. The caller hierarchy is:
kernfs_name_locked()
kernfs_name()
pr_cont_kernfs_name()
return value ignored
cgroup_name()
current_css_set_cg_links_read()
return value ignored
print_page_owner_memcg()
return value ignored
Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1]
Link: https://github.com/KSPP/linux/issues/89 [2]
Cc: Greg Kroah-Hartman <[email protected]>
Cc: Tejun Heo <[email protected]>
Cc: Azeem Shaikh <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Kees Cook <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'lib/test_fortify/write_overflow-strlcpy-src.c')
0 files changed, 0 insertions, 0 deletions