linux-kernel - Re: [PATCH] gfs2: fix overread in the strlcpy of init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAD-N9QXikfrnjD-4a8pnLYUFfcm0LdpBaXjO4=CXU5MNS-jvSQ@mail.gmail.com>
Date:   Wed, 29 Jun 2022 09:33:43 +0800
From:   Dongliang Mu <mudongliangabcd@...il.com>
To:     Andreas Gruenbacher <agruenba@...hat.com>
Cc:     Dongliang Mu <dzm91@...t.edu.cn>,
        Bob Peterson <rpeterso@...hat.com>,
        Steven Whitehouse <swhiteho@...hat.com>,
        Jean Delvare <khali@...ux-fr.org>,
        syzkaller <syzkaller@...glegroups.com>,
        cluster-devel <cluster-devel@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] gfs2: fix overread in the strlcpy of init_names

On Tue, Jun 28, 2022 at 8:06 PM Andreas Gruenbacher <agruenba@...hat.com> wrote:
>
> Dongliang Mu,
>
> On Tue, Jun 28, 2022 at 8:10 AM Dongliang Mu <dzm91@...t.edu.cn> wrote:
> > From: Dongliang Mu <mudongliangabcd@...il.com>
> >
> > In init_names, strlcpy will overread the src string as the src string is
> > less than GFS2_FSNAME_LEN(256).
> >
> > Fix this by modifying strlcpy back to snprintf, reverting
> > the commit 00377d8e3842.
>
> ... if the source string isn't NULL-terminated. But in that case, the
> code will still do the same thing with this patch. In other words,
> this doesn't fix anything. So let's check for NULL termination
> instead.

Partially yes. Even if the source string is NULL-terminated, strlcpy
will invoke memcpy to overread the adjacent memory of source string as
the specified length is longer than source string.

>
> Thanks,
> Andreas
>
> > Fixes: 00377d8e3842 ("[GFS2] Prefer strlcpy() over snprintf()")
> > Reported-by: syzkaller <syzkaller@...glegroups.com>
> > Signed-off-by: Dongliang Mu <mudongliangabcd@...il.com>
> > ---
> >  fs/gfs2/ops_fstype.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
> > index c9b423c874a3..ee29b50d39b9 100644
> > --- a/fs/gfs2/ops_fstype.c
> > +++ b/fs/gfs2/ops_fstype.c
> > @@ -383,8 +383,8 @@ static int init_names(struct gfs2_sbd *sdp, int silent)
> >         if (!table[0])
> >                 table = sdp->sd_vfs->s_id;
> >
> > -       strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN);
> > -       strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN);
> > +       snprintf(sdp->sd_proto_name, GFS2_FSNAME_LEN, "%s", proto);
> > +       snprintf(sdp->sd_table_name, GFS2_FSNAME_LEN, "%s", table);
> >
> >         table = sdp->sd_table_name;
> >         while ((table = strchr(table, '/')))
> > --
> > 2.35.1
> >
>