Re: [PATCH] lib/string: Fix UBSAN misaligned access in sized_strscpy

[Kees Cook <kees@kernel.org>]

On Tue, Feb 24, 2026 at 05:04:27PM +0000, Fuad Tabba wrote:
> sized_strscpy() performs word-at-a-time writes to the destination
> buffer. If the destination buffer is not aligned to unsigned long,
> direct assignment causes UBSAN misaligned-access errors.

Is this via CONFIG_UBSAN_ALIGNMENT=y ? Note this in the Kconfig:

          Enabling this option on architectures that support unaligned
          accesses may produce a lot of false positives.

which architecture are you checking this on?

> Use put_unaligned() to safely write the words to the destination.

Also, I thought the word-at-a-time work in sized_strscpy() was
specifically to take advantage of aligned word writes? This doesn't seem
like the right solution, and I think we're already disabling the
unaligned access by using "max=0" in the earlier checks.

I think the bug may be that you got CONFIG_UBSAN_ALIGNMENT enabled for
an arch that doesn't suffer from unaligned access problems. :) We should
fix the Kconfig!

-Kees

> 
> Fixes: 30035e45753b7 ("string: provide strscpy()")
> Signed-off-by: Fuad Tabba <tabba@google.com>
> ---
>  lib/string.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/lib/string.c b/lib/string.c
> index b632c71df1a5..a1697bf72078 100644
> --- a/lib/string.c
> +++ b/lib/string.c
> @@ -157,16 +157,16 @@ ssize_t sized_strscpy(char *dest, const char *src, size_t count)
>  		if (has_zero(c, &data, &constants)) {
>  			data = prep_zero_mask(c, data, &constants);
>  			data = create_zero_mask(data);
> -			*(unsigned long *)(dest+res) = c & zero_bytemask(data);
> +			put_unaligned(c & zero_bytemask(data), (unsigned long *)(dest+res));
>  			return res + find_zero(data);
>  		}
>  		count -= sizeof(unsigned long);
>  		if (unlikely(!count)) {
>  			c &= ALLBUTLAST_BYTE_MASK;
> -			*(unsigned long *)(dest+res) = c;
> +			put_unaligned(c, (unsigned long *)(dest+res));
>  			return -E2BIG;
>  		}
> -		*(unsigned long *)(dest+res) = c;
> +		put_unaligned(c, (unsigned long *)(dest+res));
>  		res += sizeof(unsigned long);
>  		max -= sizeof(unsigned long);
>  	}
> -- 
> 2.53.0.371.g1d285c8824-goog
> 
> 

-- 
Kees Cook