linux-kernel - [PATCH v2] block: fix length of strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20240102024115.4395-1-pugokushin@gmail.com>
Date: Tue,  2 Jan 2024 10:41:15 +0800
From: Guoxin Pu <pugokushin@...il.com>
To: axboe@...nel.dk
Cc: linux-block@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Guoxin Pu <pugokushin@...il.com>,
	stable@...r.kernel.org
Subject: [PATCH v2] block: fix length of strscpy()

In commit 146afeb235ccec10c17ad8ea26327c0c79dbd968 ("block: use strscpy()
to instead of strncpy()") , the length that should now represent the length
of the string with the terminating NULL was not updated alongside the
change.

This has caused blkdevparts= definition on kernel cmdline to be not
correctly recognized and partitions not correctly initialized, breaking any
device relying on such partitions to boot, on stable releases since 6.6

This patch fixes the lengths to contain the terminating NULL.

Fixes: 146afeb235cc ("block: use strscpy() to instead of strncpy()")
Cc: stable@...r.kernel.org # 6.6.x
Signed-off-by: Guoxin Pu <pugokushin@...il.com>
---
 block/partitions/cmdline.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/block/partitions/cmdline.c b/block/partitions/cmdline.c
index c03bc105e575..4657704c3e37 100644
--- a/block/partitions/cmdline.c
+++ b/block/partitions/cmdline.c
@@ -79,8 +79,8 @@ static int parse_subpart(struct cmdline_subpart **subpart, char *partdef)
 			goto fail;
 		}
 
-		length = min_t(int, next - partdef,
-			       sizeof(new_subpart->name) - 1);
+		length = min_t(int, next - partdef + 1,
+			       sizeof(new_subpart->name));
 		strscpy(new_subpart->name, partdef, length);
 
 		partdef = ++next;
@@ -138,7 +138,7 @@ static int parse_parts(struct cmdline_parts **parts, const char *bdevdef)
 		goto fail;
 	}
 
-	length = min_t(int, next - bdevdef, sizeof(newparts->name) - 1);
+	length = min_t(int, next - bdevdef + 1, sizeof(newparts->name));
 	strscpy(newparts->name, bdevdef, length);
 	newparts->nr_subparts = 0;
 
@@ -148,8 +148,8 @@ static int parse_parts(struct cmdline_parts **parts, const char *bdevdef)
 		bdevdef = next;
 		next = strchr(bdevdef, ',');
 
-		length = (!next) ? (sizeof(buf) - 1) :
-			min_t(int, next - bdevdef, sizeof(buf) - 1);
+		length = (!next) ? sizeof(buf) :
+			min_t(int, next - bdevdef + 1, sizeof(buf));
 
 		strscpy(buf, bdevdef, length);
 
@@ -250,7 +250,6 @@ static struct cmdline_parts *bdev_parts;
 static int add_part(int slot, struct cmdline_subpart *subpart,
 		struct parsed_partitions *state)
 {
-	int label_min;
 	struct partition_meta_info *info;
 	char tmp[sizeof(info->volname) + 4];
 
@@ -262,9 +261,7 @@ static int add_part(int slot, struct cmdline_subpart *subpart,
 
 	info = &state->parts[slot].info;
 
-	label_min = min_t(int, sizeof(info->volname) - 1,
-			  sizeof(subpart->name));
-	strscpy(info->volname, subpart->name, label_min);
+	strscpy(info->volname, subpart->name, sizeof(info->volname));
 
 	snprintf(tmp, sizeof(tmp), "(%s)", info->volname);
 	strlcat(state->pp_buf, tmp, PAGE_SIZE);
-- 
2.43.0