netdev - RE: [PATCH] net/rds: using strlcpy instead of strncpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1362421944.2956.15.camel@bwh-desktop.uk.solarflarecom.com>
Date:	Mon, 4 Mar 2013 18:32:24 +0000
From:	Ben Hutchings <bhutchings@...arflare.com>
To:	David Laight <David.Laight@...LAB.COM>
CC:	Chen Gang <gang.chen@...anux.com>,
	<venkat.x.venkatsubra@...cle.com>,
	David Miller <davem@...emloft.net>, <rds-devel@....oracle.com>,
	netdev <netdev@...r.kernel.org>
Subject: RE: [PATCH] net/rds: using strlcpy instead of strncpy

On Thu, 2013-02-28 at 09:36 +0000, David Laight wrote:
> >   when src strlen is sizeof(ctr.name) - 1, the dest str is not '\0' end.
> >   better use strlcpy instead.
> > 
> > Signed-off-by: Chen Gang <gang.chen@...anux.com>
> > ---
> >  net/rds/stats.c |    2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> > 
> > diff --git a/net/rds/stats.c b/net/rds/stats.c
> > index 7be790d..b9ac1df 100644
> > --- a/net/rds/stats.c
> > +++ b/net/rds/stats.c
> > @@ -86,7 +86,7 @@ void rds_stats_info_copy(struct rds_info_iterator *iter,
> > 
> >  	for (i = 0; i < nr; i++) {
> >  		BUG_ON(strlen(names[i]) >= sizeof(ctr.name));
> > -		strncpy(ctr.name, names[i], sizeof(ctr.name) - 1);
> > +		strlcpy(ctr.name, names[i], sizeof(ctr.name));
> >  		ctr.value = values[i];
> > 
> 
> If the target buffer ends up being copied to userspace that
> might lead to random kernel memory being leaked.

Seems it is.  The last byte of 'name' is not currently initialised and
therefore is already leaked to userland.

But it's OK because rds_info_copy() uses memcpy() not __copy_to_user(),
so SMAP will block this leak. :-)

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html