Messages in this thread | | | Date | Tue, 14 Jul 2020 08:46:29 +0100 | From | Lee Jones <> | Subject | Re: [PATCH 01/10] misc: c2port: core: Ensure source size does not equal destination size in strncpy() |
| |
On Mon, 13 Jul 2020, Geert Uytterhoeven wrote:
> Hi Lee, > > On Fri, Jun 26, 2020 at 3:06 PM Lee Jones <lee.jones@linaro.org> wrote: > > We need to ensure there's a place for the NULL terminator. > > But who's filling that space with a NUL (not NULL) terminator? > > > Fixes the following W=1 warning(s): > > > > In file included from include/linux/bitmap.h:9, > > from include/linux/nodemask.h:95, > > from include/linux/mmzone.h:17, > > from include/linux/gfp.h:6, > > from include/linux/umh.h:4, > > from include/linux/kmod.h:9, > > from include/linux/module.h:16, > > from drivers/misc/c2port/core.c:9: > > In function ‘strncpy’, > > inlined from ‘c2port_device_register’ at drivers/misc/c2port/core.c:926:2: > > include/linux/string.h:297:30: warning: ‘__builtin_strncpy’ specified bound 32 equals destination size [-Wstringop-truncation] > > 297 | #define __underlying_strncpy __builtin_strncpy > > | ^ > > include/linux/string.h:307:9: note: in expansion of macro ‘__underlying_strncpy’ > > 307 | return __underlying_strncpy(p, q, size); > > | ^~~~~~~~~~~~~~~~~~~~ > > > > Cc: Rodolfo Giometti <giometti@linux.it> > > Cc: "Eurotech S.p.A" <info@eurotech.it> > > Signed-off-by: Lee Jones <lee.jones@linaro.org> > > --- > > drivers/misc/c2port/core.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c > > index 33bba18022892..80d87e8a0bea9 100644 > > --- a/drivers/misc/c2port/core.c > > +++ b/drivers/misc/c2port/core.c > > @@ -923,7 +923,7 @@ struct c2port_device *c2port_device_register(char *name, > > } > > dev_set_drvdata(c2dev->dev, c2dev); > > c2dev is allocated using: > > c2dev = kmalloc(sizeof(struct c2port_device), GFP_KERNEL); > > hence the allocated memory is not zeroed. > > > > > - strncpy(c2dev->name, name, C2PORT_NAME_LEN); > > + strncpy(c2dev->name, name, C2PORT_NAME_LEN - 1); > > strncpy() > 1. does not terminate the destination with a NUL if the source length > is C2PORT_NAME_LEN - 1, > 2. fills all remaining space in the destination buffer with NUL characters. > > So c2dev.name[C2PORT_NAME_LEN - 1] always contains an uninitialized > value. > > Now, it seems the only caller of c2port_device_register() passes > "uc" as the name. Which means in practice c2dev.name[] will be > NUL-terminated. However, the last byte will still be uninitialized, and > if the buffer is ever copied to userspace, your patch will have introduced > a leak.
Quite right. Good spot. I must have made the assumption that the destination buffer would be pre-initialised. Not sure why it's not in this case. Seems like an odd practice.
So we have a choice. We can either enlarge the destination buffer to *actually* allow a full length (32 byte in this case) naming string, or zero the buffer.
Or even both!
Do you have a preference?
-- Lee Jones [李琼斯] Senior Technical Lead - Developer Services Linaro.org │ Open source software for Arm SoCs Follow Linaro: Facebook | Twitter | Blog
| |