* [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy
@ 2021-02-22 15:12 Romain Perier
2021-02-22 15:12 ` [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values Romain Perier
2021-02-22 16:36 ` [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy Shuah Khan
0 siblings, 2 replies; 5+ messages in thread
From: Romain Perier @ 2021-02-22 15:12 UTC (permalink / raw)
To: Kees Cook, kernel-hardening, Tejun Heo, Zefan Li, Johannes Weiner,
Herbert Xu, David S. Miller, Jiri Pirko, Sumit Semwal,
Christian König, Greg Kroah-Hartman, Mimi Zohar,
Dmitry Kasatkin, J. Bruce Fields, Chuck Lever, Geert Uytterhoeven,
Jessica Yu, Guenter Roeck, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Steffen Maier, Benjamin Block,
Martin K. Petersen, Jaroslav Kysela, Takashi Iwai, Steven Rostedt,
Ingo Molnar, Jiri Slaby, Felipe Balbi, Valentina Manea,
Shuah Khan, Shuah Khan, Wim Van Sebroeck
Cc: Romain Perier, cgroups, linux-crypto, netdev, linux-media,
dri-devel, linaro-mm-sig, Rafael J. Wysocki, linux-integrity,
linux-nfs, linux-m68k, linux-hwmon, linux-s390, linux-scsi,
target-devel, alsa-devel, linux-usb, linux-watchdog, linux-kernel
strlcpy() copy a C-String into a sized buffer, the result is always a
valid NULL-terminated that fits in the buffer, howerver it has severals
issues. It reads the source buffer first, which is dangerous if it is non
NULL-terminated or if the corresponding buffer is unbounded. Its safe
replacement is strscpy(), as suggested in the deprecated interface [1].
We plan to make this contribution in two steps:
- Firsly all cases of strlcpy's return value are manually replaced by the
corresponding calls of strscpy() with the new handling of the return
value (as the return code is different in case of error).
- Then all other cases are automatically replaced by using coccinelle.
This series covers manual replacements.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
Romain Perier (20):
cgroup: Manual replacement of the deprecated strlcpy() with return
values
crypto: Manual replacement of the deprecated strlcpy() with return
values
devlink: Manual replacement of the deprecated strlcpy() with return
values
dma-buf: Manual replacement of the deprecated strlcpy() with return
values
kobject: Manual replacement of the deprecated strlcpy() with return
values
ima: Manual replacement of the deprecated strlcpy() with return values
SUNRPC: Manual replacement of the deprecated strlcpy() with return
values
kernfs: Manual replacement of the deprecated strlcpy() with return
values
m68k/atari: Manual replacement of the deprecated strlcpy() with return
values
module: Manual replacement of the deprecated strlcpy() with return
values
hwmon: Manual replacement of the deprecated strlcpy() with return
values
s390/hmcdrv: Manual replacement of the deprecated strlcpy() with
return values
scsi: zfcp: Manual replacement of the deprecated strlcpy() with return
values
target: Manual replacement of the deprecated strlcpy() with return
values
ALSA: usb-audio: Manual replacement of the deprecated strlcpy() with
return values
tracing/probe: Manual replacement of the deprecated strlcpy() with
return values
vt: Manual replacement of the deprecated strlcpy() with return values
usb: gadget: f_midi: Manual replacement of the deprecated strlcpy()
with return values
usbip: usbip_host: Manual replacement of the deprecated strlcpy() with
return values
s390/watchdog: Manual replacement of the deprecated strlcpy() with
return values
arch/m68k/emu/natfeat.c | 6 +--
crypto/lrw.c | 6 +--
crypto/xts.c | 6 +--
drivers/dma-buf/dma-buf.c | 4 +-
drivers/hwmon/pmbus/max20730.c | 66 +++++++++++++------------
drivers/s390/char/diag_ftp.c | 4 +-
drivers/s390/char/sclp_ftp.c | 6 +--
drivers/s390/scsi/zfcp_fc.c | 8 +--
drivers/target/target_core_configfs.c | 33 ++++---------
drivers/tty/vt/keyboard.c | 5 +-
drivers/usb/gadget/function/f_midi.c | 4 +-
drivers/usb/gadget/function/f_printer.c | 8 +--
drivers/usb/usbip/stub_main.c | 6 +--
drivers/watchdog/diag288_wdt.c | 12 +++--
fs/kernfs/dir.c | 27 +++++-----
kernel/cgroup/cgroup.c | 2 +-
kernel/module.c | 4 +-
kernel/trace/trace_uprobe.c | 11 ++---
lib/kobject_uevent.c | 6 +--
net/core/devlink.c | 6 +--
net/sunrpc/clnt.c | 6 ++-
security/integrity/ima/ima_policy.c | 8 ++-
sound/usb/card.c | 4 +-
23 files changed, 129 insertions(+), 119 deletions(-)
--
2.20.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values
2021-02-22 15:12 [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy Romain Perier
@ 2021-02-22 15:12 ` Romain Perier
2021-02-22 15:46 ` Guenter Roeck
2021-02-22 16:36 ` [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy Shuah Khan
1 sibling, 1 reply; 5+ messages in thread
From: Romain Perier @ 2021-02-22 15:12 UTC (permalink / raw)
To: Kees Cook, kernel-hardening, Guenter Roeck
Cc: Romain Perier, linux-hwmon, linux-kernel
The strlcpy() reads the entire source buffer first, it is dangerous if
the source buffer lenght is unbounded or possibility non NULL-terminated.
It can lead to linear read overflows, crashes, etc...
As recommended in the deprecated interfaces [1], it should be replaced
by strscpy.
This commit replaces all calls to strlcpy that handle the return values
by the corresponding strscpy calls with new handling of the return
values (as it is quite different between the two functions).
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
Signed-off-by: Romain Perier <romain.perier@gmail.com>
---
drivers/hwmon/pmbus/max20730.c | 66 +++++++++++++++++++++--------------------
1 file changed, 35 insertions(+), 31 deletions(-)
diff --git a/drivers/hwmon/pmbus/max20730.c b/drivers/hwmon/pmbus/max20730.c
index 9dd3dd79bc18..a384b57b7327 100644
--- a/drivers/hwmon/pmbus/max20730.c
+++ b/drivers/hwmon/pmbus/max20730.c
@@ -107,7 +107,8 @@ struct max20730_debugfs_data {
static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
size_t count, loff_t *ppos)
{
- int ret, len;
+ int ret;
+ ssize_t len;
int *idxp = file->private_data;
int idx = *idxp;
struct max20730_debugfs_data *psu = to_psu(idxp, idx);
@@ -148,13 +149,13 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
>> MAX20730_MFR_DEVSET1_TSTAT_BIT_POS;
if (val == 0)
- len = strlcpy(tbuf, "2000\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "2000\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "125\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "125\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "62.5\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "62.5\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "32\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "32\n", DEBUG_FS_DATA_MAX);
break;
case MAX20730_DEBUGFS_INTERNAL_GAIN:
val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_RGAIN_MASK)
@@ -163,35 +164,35 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
if (data->id == max20734) {
/* AN6209 */
if (val == 0)
- len = strlcpy(tbuf, "0.8\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.8\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "3.2\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "3.2\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "1.6\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "1.6\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "6.4\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "6.4\n", DEBUG_FS_DATA_MAX);
} else if (data->id == max20730 || data->id == max20710) {
/* AN6042 or AN6140 */
if (val == 0)
- len = strlcpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "7.2\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "7.2\n", DEBUG_FS_DATA_MAX);
} else if (data->id == max20743) {
/* AN6042 */
if (val == 0)
- len = strlcpy(tbuf, "0.45\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.45\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
} else {
- len = strlcpy(tbuf, "Not supported\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "Not supported\n", DEBUG_FS_DATA_MAX);
}
break;
case MAX20730_DEBUGFS_BOOT_VOLTAGE:
@@ -199,26 +200,26 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
>> MAX20730_MFR_DEVSET1_VBOOT_BIT_POS;
if (val == 0)
- len = strlcpy(tbuf, "0.6484\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.6484\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "0.8984\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.8984\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "1.0\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "1.0\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
break;
case MAX20730_DEBUGFS_OUT_V_RAMP_RATE:
val = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_VRATE)
>> MAX20730_MFR_DEVSET2_VRATE_BIT_POS;
if (val == 0)
- len = strlcpy(tbuf, "4\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "4\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "2\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "2\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "1\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "1\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
break;
case MAX20730_DEBUGFS_OC_PROTECT_MODE:
ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_OCPM_MASK)
@@ -230,13 +231,13 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
>> MAX20730_MFR_DEVSET2_SS_BIT_POS;
if (val == 0)
- len = strlcpy(tbuf, "0.75\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "0.75\n", DEBUG_FS_DATA_MAX);
else if (val == 1)
- len = strlcpy(tbuf, "1.5\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "1.5\n", DEBUG_FS_DATA_MAX);
else if (val == 2)
- len = strlcpy(tbuf, "3\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "3\n", DEBUG_FS_DATA_MAX);
else
- len = strlcpy(tbuf, "6\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "6\n", DEBUG_FS_DATA_MAX);
break;
case MAX20730_DEBUGFS_IMAX:
ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_IMAX_MASK)
@@ -287,9 +288,12 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
"%d.%d\n", ret / 10000, ret % 10000);
break;
default:
- len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
+ len = strscpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
}
+ if (len == -E2BIG)
+ return -E2BIG;
+
return simple_read_from_buffer(buf, count, ppos, tbuf, len);
}
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values
2021-02-22 15:12 ` [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values Romain Perier
@ 2021-02-22 15:46 ` Guenter Roeck
2021-02-28 11:50 ` Joe Perches
0 siblings, 1 reply; 5+ messages in thread
From: Guenter Roeck @ 2021-02-22 15:46 UTC (permalink / raw)
To: Romain Perier, Kees Cook, kernel-hardening; +Cc: linux-hwmon, linux-kernel
On 2/22/21 7:12 AM, Romain Perier wrote:
> The strlcpy() reads the entire source buffer first, it is dangerous if
> the source buffer lenght is unbounded or possibility non NULL-terminated.
length
> It can lead to linear read overflows, crashes, etc...
>
Not here. This description is misleading.
> As recommended in the deprecated interfaces [1], it should be replaced
> by strscpy.
>
> This commit replaces all calls to strlcpy that handle the return values
> by the corresponding strscpy calls with new handling of the return
> values (as it is quite different between the two functions).
>
> [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
>
> Signed-off-by: Romain Perier <romain.perier@gmail.com>
This patch just adds pain to injury, as the source 'buffers' are all fixed
strings and their length will never exceed the maximum buffer length.
I really don't see the point of using strscpy() in this situation.
> ---
> drivers/hwmon/pmbus/max20730.c | 66 +++++++++++++++++++++--------------------
This patch only modifies a single driver and should be tagged as such.
> 1 file changed, 35 insertions(+), 31 deletions(-)
>
> diff --git a/drivers/hwmon/pmbus/max20730.c b/drivers/hwmon/pmbus/max20730.c
> index 9dd3dd79bc18..a384b57b7327 100644
> --- a/drivers/hwmon/pmbus/max20730.c
> +++ b/drivers/hwmon/pmbus/max20730.c
> @@ -107,7 +107,8 @@ struct max20730_debugfs_data {
> static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> size_t count, loff_t *ppos)
> {
> - int ret, len;
> + int ret;
> + ssize_t len;
> int *idxp = file->private_data;
> int idx = *idxp;
> struct max20730_debugfs_data *psu = to_psu(idxp, idx);
> @@ -148,13 +149,13 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> >> MAX20730_MFR_DEVSET1_TSTAT_BIT_POS;
>
> if (val == 0)
> - len = strlcpy(tbuf, "2000\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "2000\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "125\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "125\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "62.5\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "62.5\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "32\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "32\n", DEBUG_FS_DATA_MAX);
> break;
> case MAX20730_DEBUGFS_INTERNAL_GAIN:
> val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_RGAIN_MASK)
> @@ -163,35 +164,35 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> if (data->id == max20734) {
> /* AN6209 */
> if (val == 0)
> - len = strlcpy(tbuf, "0.8\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.8\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "3.2\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "3.2\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "1.6\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "1.6\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "6.4\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "6.4\n", DEBUG_FS_DATA_MAX);
> } else if (data->id == max20730 || data->id == max20710) {
> /* AN6042 or AN6140 */
> if (val == 0)
> - len = strlcpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "7.2\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "7.2\n", DEBUG_FS_DATA_MAX);
> } else if (data->id == max20743) {
> /* AN6042 */
> if (val == 0)
> - len = strlcpy(tbuf, "0.45\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.45\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "1.8\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.9\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "3.6\n", DEBUG_FS_DATA_MAX);
> } else {
> - len = strlcpy(tbuf, "Not supported\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "Not supported\n", DEBUG_FS_DATA_MAX);
> }
> break;
> case MAX20730_DEBUGFS_BOOT_VOLTAGE:
> @@ -199,26 +200,26 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> >> MAX20730_MFR_DEVSET1_VBOOT_BIT_POS;
>
> if (val == 0)
> - len = strlcpy(tbuf, "0.6484\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.6484\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "0.8984\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.8984\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "1.0\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "1.0\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
> break;
> case MAX20730_DEBUGFS_OUT_V_RAMP_RATE:
> val = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_VRATE)
> >> MAX20730_MFR_DEVSET2_VRATE_BIT_POS;
>
> if (val == 0)
> - len = strlcpy(tbuf, "4\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "4\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "2\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "2\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "1\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "1\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
> break;
> case MAX20730_DEBUGFS_OC_PROTECT_MODE:
> ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_OCPM_MASK)
> @@ -230,13 +231,13 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> >> MAX20730_MFR_DEVSET2_SS_BIT_POS;
>
> if (val == 0)
> - len = strlcpy(tbuf, "0.75\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "0.75\n", DEBUG_FS_DATA_MAX);
> else if (val == 1)
> - len = strlcpy(tbuf, "1.5\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "1.5\n", DEBUG_FS_DATA_MAX);
> else if (val == 2)
> - len = strlcpy(tbuf, "3\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "3\n", DEBUG_FS_DATA_MAX);
> else
> - len = strlcpy(tbuf, "6\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "6\n", DEBUG_FS_DATA_MAX);
> break;
> case MAX20730_DEBUGFS_IMAX:
> ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_IMAX_MASK)
> @@ -287,9 +288,12 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> "%d.%d\n", ret / 10000, ret % 10000);
> break;
> default:
> - len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
> + len = strscpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
> }
>
> + if (len == -E2BIG)
> + return -E2BIG;
> +
> return simple_read_from_buffer(buf, count, ppos, tbuf, len);
> }
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy
2021-02-22 15:12 [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy Romain Perier
2021-02-22 15:12 ` [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values Romain Perier
@ 2021-02-22 16:36 ` Shuah Khan
1 sibling, 0 replies; 5+ messages in thread
From: Shuah Khan @ 2021-02-22 16:36 UTC (permalink / raw)
To: Romain Perier, Kees Cook, kernel-hardening, Tejun Heo, Zefan Li,
Johannes Weiner, Herbert Xu, David S. Miller, Jiri Pirko,
Sumit Semwal, Christian König, Greg Kroah-Hartman,
Mimi Zohar, Dmitry Kasatkin, J. Bruce Fields, Chuck Lever,
Geert Uytterhoeven, Jessica Yu, Guenter Roeck, Heiko Carstens,
Vasily Gorbik, Christian Borntraeger, Steffen Maier,
Benjamin Block, Martin K. Petersen, Jaroslav Kysela, Takashi Iwai,
Steven Rostedt, Ingo Molnar, Jiri Slaby, Felipe Balbi,
Valentina Manea, Shuah Khan, Wim Van Sebroeck
Cc: cgroups, linux-crypto, netdev, linux-media, dri-devel,
linaro-mm-sig, Rafael J. Wysocki, linux-integrity, linux-nfs,
linux-m68k, linux-hwmon, linux-s390, linux-scsi, target-devel,
alsa-devel, linux-usb, linux-watchdog, linux-kernel, Shuah Khan
On 2/22/21 8:12 AM, Romain Perier wrote:
> strlcpy() copy a C-String into a sized buffer, the result is always a
> valid NULL-terminated that fits in the buffer, howerver it has severals
> issues. It reads the source buffer first, which is dangerous if it is non
> NULL-terminated or if the corresponding buffer is unbounded. Its safe
> replacement is strscpy(), as suggested in the deprecated interface [1].
>
> We plan to make this contribution in two steps:
> - Firsly all cases of strlcpy's return value are manually replaced by the
> corresponding calls of strscpy() with the new handling of the return
> value (as the return code is different in case of error).
> - Then all other cases are automatically replaced by using coccinelle.
>
Cool. A quick check shows me 1031 strscpy() calls with no return
checks. All or some of these probably need to be reviewed and add
return checks. Is this something that is in the plan to address as
part of this work?
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values
2021-02-22 15:46 ` Guenter Roeck
@ 2021-02-28 11:50 ` Joe Perches
0 siblings, 0 replies; 5+ messages in thread
From: Joe Perches @ 2021-02-28 11:50 UTC (permalink / raw)
To: Guenter Roeck, Romain Perier, Kees Cook, kernel-hardening
Cc: linux-hwmon, linux-kernel
On Mon, 2021-02-22 at 07:46 -0800, Guenter Roeck wrote:
> On 2/22/21 7:12 AM, Romain Perier wrote:
> > The strlcpy() reads the entire source buffer first, it is dangerous if
> > the source buffer lenght is unbounded or possibility non NULL-terminated.
>
> length
>
> > It can lead to linear read overflows, crashes, etc...
> >
> Not here. This description is misleading.
>
> > As recommended in the deprecated interfaces [1], it should be replaced
> > by strscpy.
> >
> > This commit replaces all calls to strlcpy that handle the return values
> > by the corresponding strscpy calls with new handling of the return
> > values (as it is quite different between the two functions).
> >
> > [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
> >
> > Signed-off-by: Romain Perier <romain.perier@gmail.com>
>
> This patch just adds pain to injury, as the source 'buffers' are all fixed
> strings and their length will never exceed the maximum buffer length.
> I really don't see the point of using strscpy() in this situation.
Might as well just use strcpy (I'd still prefer stracpy)
https://lore.kernel.org/lkml/24bb53c57767c1c2a8f266c305a670f7@sk2.org/T/
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-28 12:00 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-02-22 15:12 [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy Romain Perier
2021-02-22 15:12 ` [PATCH 11/20] hwmon: Manual replacement of the deprecated strlcpy() with return values Romain Perier
2021-02-22 15:46 ` Guenter Roeck
2021-02-28 11:50 ` Joe Perches
2021-02-22 16:36 ` [PATCH 00/20] Manual replacement of all strlcpy in favor of strscpy Shuah Khan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox