linux-kernel - Re: strlcpy() notes (was Re: [GIT PULL] smb3 client fixes)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YwSWLH4Wp6yDMeKf@arm.com>
Date:   Tue, 23 Aug 2022 09:56:12 +0100
From:   Catalin Marinas <catalin.marinas@....com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Steve French <smfrench@...il.com>,
        CIFS <linux-cifs@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-arch <linux-arch@...r.kernel.org>
Subject: Re: strlcpy() notes (was Re: [GIT PULL] smb3 client fixes)

On Sun, Aug 21, 2022 at 11:13:28AM -0700, Linus Torvalds wrote:
> It's also worth pointing out that the kernel implementation of
> 'strscpy()' will not do the chunk-sized accesses across an unaligned
> page boundary. So it won't actually take a page fault past the
> terminating NUL character, but if you pass it an 'N' that is bigger
> than the source buffer, and you have sub-page faults in the kernel, we
> might need to do some further work in this are. Catalin?

We can probably hit sub-page faults if the function reads past the end
of a string. Strange that we haven't hit any so far (well, it needs
KASAN_HW_TAGS enabled, it doesn't get as much coverage).

With load_unaligned_zeropad(), the arm64 implementation disables tag
checking temporarily. We could do the same with read_word_at_a_time()
(there is a kasan_check_read() in this function but it wrongly uses a
size of 1).

I'll send a patch but most likely next week (I'm still on holiday).

-- 
Catalin