netdev - [PATCH v9 5/7] mm/util: Fix possible race condition in kstrdup()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241007144911.27693-6-laoar.shao@gmail.com>
Date: Mon,  7 Oct 2024 22:49:09 +0800
From: Yafang Shao <laoar.shao@...il.com>
To: akpm@...ux-foundation.org
Cc: torvalds@...ux-foundation.org,
	keescook@...omium.org,
	alx@...nel.org,
	justinstitt@...gle.com,
	ebiederm@...ssion.com,
	alexei.starovoitov@...il.com,
	rostedt@...dmis.org,
	catalin.marinas@....com,
	penguin-kernel@...ove.sakura.ne.jp,
	linux-mm@...ck.org,
	linux-fsdevel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	audit@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	selinux@...r.kernel.org,
	bpf@...r.kernel.org,
	netdev@...r.kernel.org,
	dri-devel@...ts.freedesktop.org,
	Yafang Shao <laoar.shao@...il.com>,
	Andy Shevchenko <andy.shevchenko@...il.com>
Subject: [PATCH v9 5/7] mm/util: Fix possible race condition in kstrdup()

In kstrdup(), it is critical to ensure that the dest string is always
NUL-terminated. However, potential race condition can occur between a
writer and a reader.

Consider the following scenario involving task->comm:

    reader                    writer

  len = strlen(s) + 1;
                             strlcpy(tsk->comm, buf, sizeof(tsk->comm));
  memcpy(buf, s, len);

In this case, there is a race condition between the reader and the
writer. The reader calculates the length of the string `s` based on the
old value of task->comm. However, during the memcpy(), the string `s`
might be updated by the writer to a new value of task->comm.

If the new task->comm is larger than the old one, the `buf` might not be
NUL-terminated. This can lead to undefined behavior and potential
security vulnerabilities.

Let's fix it by explicitly adding a NUL terminator after the memcpy. It
is worth noting that memcpy() is not atomic, so the new string can be
shorter when memcpy() already copied past the new NUL.

Signed-off-by: Yafang Shao <laoar.shao@...il.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Alejandro Colomar <alx@...nel.org>
Cc: Andy Shevchenko <andy.shevchenko@...il.com>
---
 mm/util.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mm/util.c b/mm/util.c
index 4f1275023eb7..858a9a2f57e7 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -62,8 +62,15 @@ char *kstrdup(const char *s, gfp_t gfp)

 	len = strlen(s) + 1;
 	buf = kmalloc_track_caller(len, gfp);
-	if (buf)
+	if (buf) {
 		memcpy(buf, s, len);
+		/*
+		 * During memcpy(), the string might be updated to a new value,
+		 * which could be longer than the string when strlen() is
+		 * called. Therefore, we need to add a NUL terminator.
+		 */
+		buf[len - 1] = '\0';
+	}
 	return buf;
 }
 EXPORT_SYMBOL(kstrdup);
-- 
2.43.5