From: Kees Cook <keescook@chromium.org>
To: Justin Stitt <justinstitt@google.com>
Cc: Borislav Petkov <bp@alien8.de>, Tony Luck <tony.luck@intel.com>,
James Morse <james.morse@arm.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Robert Richter <rric@kernel.org>,
linux-edac@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-hardening@vger.kernel.org
Subject: Re: [PATCH v3] EDAC/mc_sysfs: refactor deprecated strncpy
Date: Thu, 14 Sep 2023 20:53:37 -0700 [thread overview]
Message-ID: <202309142045.7CBAE940E@keescook> (raw)
In-Reply-To: <20230913-strncpy-drivers-edac-edac_mc_sysfs-c-v3-1-38c1db7d207f@google.com>
On Wed, Sep 13, 2023 at 05:20:50PM +0000, Justin Stitt wrote:
> `strncpy` is deprecated for use on NUL-terminated destination strings [1].
>
> We should prefer more robust and less ambiguous string interfaces.
>
> A suitable replacement is `strscpy` [2] due to the fact that it
> guarantees NUL-termination on the destination buffer without needlessly
> NUL-padding.
>
> Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
> Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2]
> Link: https://github.com/KSPP/linux/issues/90
> Cc: linux-hardening@vger.kernel.org
> Signed-off-by: Justin Stitt <justinstitt@google.com>
> ---
> Changes in v3:
> - prefer strscpy to strscpy_pad (thanks Tony)
> - Link to v2: https://lore.kernel.org/r/20230913-strncpy-drivers-edac-edac_mc_sysfs-c-v2-1-2d2e6bd43642@google.com
>
> Changes in v2:
> - included refactor of another strncpy in same file
> - Link to v1: https://lore.kernel.org/r/20230913-strncpy-drivers-edac-edac_mc_sysfs-c-v1-1-d232891b05b0@google.com
> ---
> Note: build-tested only.
> ---
> drivers/edac/edac_mc_sysfs.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
> index 15f63452a9be..9a5b4bbd8191 100644
> --- a/drivers/edac/edac_mc_sysfs.c
> +++ b/drivers/edac/edac_mc_sysfs.c
> @@ -229,8 +229,7 @@ static ssize_t channel_dimm_label_store(struct device *dev,
> if (copy_count == 0 || copy_count >= sizeof(rank->dimm->label))
> return -EINVAL;
>
> - strncpy(rank->dimm->label, data, copy_count);
> - rank->dimm->label[copy_count] = '\0';
> + strscpy(rank->dimm->label, data, copy_count);
Hrm, I don't like the use of "copy_count" here -- it's the source
length, not the destination buffer size. It is technically safe because
it was bounds-checked right before, but now we run the risk of
additional truncation since "copy_count" will not include the '\0'.
Imagine data = "a", count = 1. strscpy(dst, data, 1) will only copy
'\0'.
I think this should be memcpy(), not strscpy(). The bounds checking and
truncation of '\n' has already been calculated -- we're just doing a
byte copy at this point:
if (count == 0)
return -EINVAL;
if (data[count - 1] == '\0' || data[count - 1] == '\n')
copy_count -= 1;
if (copy_count == 0 || copy_count >= sizeof(rank->dimm->label))
return -EINVAL;
memcpy(rank->dimm->label, data, copy_count);
rank->dimm->label[copy_count] = '\0';
>
> return count;
> }
> @@ -535,7 +534,7 @@ static ssize_t dimmdev_label_store(struct device *dev,
> if (copy_count == 0 || copy_count >= sizeof(dimm->label))
> return -EINVAL;
>
> - strncpy(dimm->label, data, copy_count);
> + strscpy(dimm->label, data, copy_count);
> dimm->label[copy_count] = '\0';
Same for this one: replace strncpy with memcpy.
-Kees
>
> return count;
>
> ---
> base-commit: 2dde18cd1d8fac735875f2e4987f11817cc0bc2c
> change-id: 20230913-strncpy-drivers-edac-edac_mc_sysfs-c-e619b00124a3
>
> Best regards,
> --
> Justin Stitt <justinstitt@google.com>
>
--
Kees Cook
prev parent reply other threads:[~2023-09-15 3:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-13 17:20 [PATCH v3] EDAC/mc_sysfs: refactor deprecated strncpy Justin Stitt
2023-09-15 3:53 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202309142045.7CBAE940E@keescook \
--to=keescook@chromium.org \
--cc=bp@alien8.de \
--cc=james.morse@arm.com \
--cc=justinstitt@google.com \
--cc=linux-edac@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=rric@kernel.org \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).