Messages in this thread | | | Date | Wed, 18 Oct 2023 21:16:15 +0200 | From | "Arnd Bergmann" <> | Subject | Re: [PATCH] string: Adjust strtomem_pad() logic to allow for smaller sources |
| |
On Wed, Oct 18, 2023, at 20:07, Kees Cook wrote: > Arnd noticed we have a case where a shorter source string is being copied > into a destination byte array, but this results in a strnlen() call that > exceeds the size of the source. This is seen with -Wstringop-overread: > > In file included from ../include/linux/uuid.h:11, > from ../include/linux/mod_devicetable.h:14, > from ../include/linux/cpufeature.h:12, > from ../arch/x86/coco/tdx/tdx.c:7: > ../arch/x86/coco/tdx/tdx.c: In function 'tdx_panic.constprop': > ../include/linux/string.h:284:9: error: 'strnlen' specified bound 64 > exceeds source size 60 [-Werror=stringop-overread] > 284 | memcpy_and_pad(dest, _dest_len, src, strnlen(src, > _dest_len), pad); \ > | > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > ../arch/x86/coco/tdx/tdx.c:124:9: note: in expansion of macro > 'strtomem_pad' > 124 | strtomem_pad(message.str, msg, '\0'); > | ^~~~~~~~~~~~ > > Use the smaller of the two buffer sizes when calling strnlen(). When > src length is unknown (SIZE_MAX), it will use dest length, which is what > the original code did. > > Reported-by: Arnd Bergmann <arnd@arndb.de> > Fixes: dfbafa70bde2 ("string: Introduce strtomem() and strtomem_pad()") > Cc: Andy Shevchenko <andy@kernel.org> > Cc: linux-hardening@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org>
Thanks for addressing this, looks good
Tested-by: Arnd Bergmann <arnd@arndb.de>
| |