| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240129092952.1980246-1-lee@kernel.org>
Date: Mon, 29 Jan 2024 09:29:52 +0000
From: Lee Jones <lee@...nel.org>
To: lee@...nel.org
Cc: linux-kernel@...r.kernel.org,
linux-hardening@...r.kernel.org,
Andrew Morton <akpm@...ux-foundation.org>,
Petr Mladek <pmladek@...e.com>,
Steven Rostedt <rostedt@...dmis.org>,
Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
Rasmus Villemoes <linux@...musvillemoes.dk>,
Sergey Senozhatsky <senozhatsky@...omium.org>,
Crutcher Dunnavant <crutcher+kernel@...astacks.com>,
Juergen Quade <quade@...r.de>,
David Laight <David.Laight@...lab.com>
Subject: [PATCH v2 1/1] lib/vsprintf: Implement ssprintf() to catch truncated strings
There is an ongoing effort to replace the use of {v}snprintf() variants
with safer alternatives - for a more in depth view, see Jon's write-up
on LWN [0] and/or Alex's on the Kernel Self Protection Project [1].
Whist executing the task, it quickly became apparent that the initial
thought of simply s/snprintf/scnprintf/ wasn't going to be adequate for
a number of cases. Specifically ones where the caller needs to know
whether the given string ends up being truncated. This is where
ssprintf() [based on similar semantics of strscpy()] comes in, since it
takes the best parts of both of the aforementioned variants. It has the
testability of truncation of snprintf() and returns the number of Bytes
*actually* written, similar to scnprintf(), making it a very programmer
friendly alternative.
Here's some examples to show the differences:
Success: No truncation - all 9 Bytes successfully written to the buffer
ret = snprintf (buf, 10, "%s", "123456789"); // ret = 9
ret = scnprintf(buf, 10, "%s", "123456789"); // ret = 9
ret = ssprintf (buf, 10, "%s", "123456789"); // ret = 9
Failure: Truncation - only 9 of 10 Bytes written; '-' is truncated
ret = snprintf (buf, 10, "%s", "123456789-"); // ret = 10
Reports: "10 Bytes would have been written if buf was large enough"
Issue: Programmers need to know/remember to check ret against "10"
ret = scnprintf(buf, 10, "%s", "123456789-"); // ret = 9
Reports: "9 Bytes actually written"
Issue: Returns 9 on success AND failure (see above)
ret = ssprintf (buf, 10, "%s", "123456789-"); // ret = -E2BIG
Reports: "Data provided is too large to fit in the buffer"
Issue: No tangible impact: No way to tell how much data was lost
[0] https://lwn.net/Articles/69419/
[1] https://github.com/KSPP/linux/issues/105
Signed-off-by: Lee Jones <lee@...nel.org>
---
Changelog:
v1 => v2:
- Address Rasmus Villemoes's review comments:
- Remove explicit check for zero sized buffer (-E2BIG is appropriate)
- Remove unreachable branch in vssprintf()
include/linux/sprintf.h | 2 ++
lib/vsprintf.c | 51 +++++++++++++++++++++++++++++++++++++++++
2 files changed, 53 insertions(+)
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Petr Mladek <pmladek@...e.com>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc: Rasmus Villemoes <linux@...musvillemoes.dk>
Cc: Sergey Senozhatsky <senozhatsky@...omium.org>
Cc: Crutcher Dunnavant <crutcher+kernel@...astacks.com>
Cc: Juergen Quade <quade@...r.de>
Cc: David Laight <David.Laight@...lab.com>
diff --git a/include/linux/sprintf.h b/include/linux/sprintf.h
index 33dcbec719254..2a3db6285492a 100644
--- a/include/linux/sprintf.h
+++ b/include/linux/sprintf.h
@@ -13,6 +13,8 @@ __printf(3, 4) int snprintf(char *buf, size_t size, const char *fmt, ...);
__printf(3, 0) int vsnprintf(char *buf, size_t size, const char *fmt, va_list args);
__printf(3, 4) int scnprintf(char *buf, size_t size, const char *fmt, ...);
__printf(3, 0) int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
+__printf(3, 4) int ssprintf(char *buf, size_t size, const char *fmt, ...);
+__printf(3, 0) int vssprintf(char *buf, size_t size, const char *fmt, va_list args);
__printf(2, 3) __malloc char *kasprintf(gfp_t gfp, const char *fmt, ...);
__printf(2, 0) __malloc char *kvasprintf(gfp_t gfp, const char *fmt, va_list args);
__printf(2, 0) const char *kvasprintf_const(gfp_t gfp, const char *fmt, va_list args);
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 552738f14275a..e2b51fc625564 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2936,6 +2936,34 @@ int vscnprintf(char *buf, size_t size, const char *fmt, va_list args)
}
EXPORT_SYMBOL(vscnprintf);
+/**
+ * vssprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @args: Arguments for the format string
+ *
+ * The return value is the number of characters which have been written into
+ * the @buf not including the trailing '\0' or -E2BIG if the string was
+ * truncated.
+ *
+ * If you're not already dealing with a va_list consider using ssprintf().
+ *
+ * See the vsnprintf() documentation for format string extensions over C99.
+ */
+int vssprintf(char *buf, size_t size, const char *fmt, va_list args)
+{
+ int i;
+
+ i = vsnprintf(buf, size, fmt, args);
+
+ if (likely(i < size))
+ return i;
+
+ return -E2BIG;
+}
+EXPORT_SYMBOL(vssprintf);
+
/**
* snprintf - Format a string and place it in a buffer
* @buf: The buffer to place the result into
@@ -2987,6 +3015,29 @@ int scnprintf(char *buf, size_t size, const char *fmt, ...)
}
EXPORT_SYMBOL(scnprintf);
+/**
+ * ssprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @...: Arguments for the format string
+ *
+ * The return value is the number of characters written into @buf not including
+ * the trailing '\0' or -E2BIG if the string was truncated.
+ */
+int ssprintf(char *buf, size_t size, const char *fmt, ...)
+{
+ va_list args;
+ int i;
+
+ va_start(args, fmt);
+ i = vssprintf(buf, size, fmt, args);
+ va_end(args);
+
+ return i;
+}
+EXPORT_SYMBOL(ssprintf);
+
/**
* vsprintf - Format a string and place it in a buffer
* @buf: The buffer to place the result into
--
2.43.0.429.g432eaa2c6b-goog
Powered by blists - more mailing lists