From: Francis Laniel <laniel_francis@privacyrequired.com>
To: Kees Cook <keescook@chromium.org>
Cc: Jakub Kicinski <kuba@kernel.org>,
linux-hardening@vger.kernel.org, davem@davemloft.net
Subject: Re: [RFC][PATCH v2 2/3] Modify return value of nla_strlcpy to match that of strscpy.
Date: Tue, 20 Oct 2020 15:05:44 +0200 [thread overview]
Message-ID: <3157734.8NJyI8pP3B@machine> (raw)
In-Reply-To: <202010191559.3AC2C3F97@keescook>
Le mardi 20 octobre 2020, 01:01:27 CEST Kees Cook a écrit :
> On Mon, Oct 19, 2020 at 09:43:55AM -0700, Jakub Kicinski wrote:
> > On Mon, 19 Oct 2020 17:23:30 +0200 laniel_francis@privacyrequired.com
> >
> > wrote:
> > > -size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
> > > +ssize_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t
> > > dstsize)
> > >
> > > {
> > >
> > > + size_t len;
> > > + ssize_t ret;
> > >
> > > size_t srclen = nla_len(nla);
> > > char *src = nla_data(nla);
> >
> > Sort local variables long to short.
>
> Specifically, "reverse christmas tree":
>
> size_t srclen = nla_len(nla);
> char *src = nla_data(nla);
> size_t len;
> ssize_t ret;
>
> > > diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
> > > index 41a55c6cbeb8..f0bf64393cbf 100644
> > > --- a/net/sched/cls_api.c
> > > +++ b/net/sched/cls_api.c
> > > @@ -223,7 +223,7 @@ static inline u32 tcf_auto_prio(struct tcf_proto
> > > *tp)
> > >
> > > static bool tcf_proto_check_kind(struct nlattr *kind, char *name)
> > > {
> > >
> > > if (kind)
> > >
> > > - return nla_strlcpy(name, kind, IFNAMSIZ) >= IFNAMSIZ;
> > > + return nla_strlcpy(name, kind, IFNAMSIZ) > 0;
> >
> > Bug.
> >
> > > memset(name, 0, IFNAMSIZ);
> > > return false;
> > >
> > > }
>
> Have you been able to exercise the changed code paths? (I would have
> expected this to immediately fail, for example.)
Unfortunately no...
As I said in the cover letter I only tested the modifications on char* and the
tcf_proto_check_kind function seems not to be called in my VM...
I will try to trigger it though!
next prev parent reply other threads:[~2020-10-20 13:05 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-16 12:52 [RFC][PATCH v1] Fix and rename nla_strlcpy to nla_strcpy laniel_francis
2020-10-16 12:52 ` [PATCH v1 1/3] Fix unefficient call to memset before memcpu in nla_strlcpy laniel_francis
2020-10-16 23:19 ` Kees Cook
2020-10-17 8:50 ` Francis Laniel
2020-10-16 23:29 ` Jann Horn
2020-10-17 8:50 ` Francis Laniel
2020-10-16 12:52 ` [PATCH v1 2/3] Modify return value of nla_strlcpy to match that of strscpy laniel_francis
2020-10-16 23:23 ` Kees Cook
2020-10-17 8:53 ` Francis Laniel
2020-10-17 0:41 ` Jann Horn
2020-10-17 8:56 ` Francis Laniel
2020-10-16 12:52 ` [PATCH v1 3/3] Rename nla_strlcpy to nla_strcpy laniel_francis
2020-10-16 23:18 ` Kees Cook
2020-10-19 15:23 ` [RFC][PATCH v2 0/3] Fix inefficiences and rename nla_strlcpy laniel_francis
2020-10-19 15:23 ` [RFC][PATCH v2 1/3] Fix unefficient call to memset before memcpu in nla_strlcpy laniel_francis
2020-10-19 15:23 ` [RFC][PATCH v2 2/3] Modify return value of nla_strlcpy to match that of strscpy laniel_francis
2020-10-19 16:43 ` Jakub Kicinski
2020-10-19 23:01 ` Kees Cook
2020-10-19 23:34 ` Jakub Kicinski
2020-10-20 10:28 ` Francis Laniel
2020-10-20 17:23 ` Kees Cook
2020-10-20 17:19 ` Kees Cook
2020-10-20 13:05 ` Francis Laniel [this message]
2020-10-20 10:17 ` Francis Laniel
2020-10-19 15:23 ` [RFC][PATCH v2 3/3] Rename nla_strlcpy to nla_strcpy laniel_francis
2020-10-19 16:45 ` [RFC][PATCH v2 0/3] Fix inefficiences and rename nla_strlcpy Jakub Kicinski
2020-10-19 22:58 ` Kees Cook
2020-10-19 23:34 ` Jakub Kicinski
2020-10-20 10:18 ` Francis Laniel
2020-10-19 23:03 ` Kees Cook
2020-10-20 13:06 ` Francis Laniel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3157734.8NJyI8pP3B@machine \
--to=laniel_francis@privacyrequired.com \
--cc=davem@davemloft.net \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-hardening@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.