From patchwork Thu Nov 30 20:12:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13474998 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="OQ9rBmLH" Received: from mail-pl1-x632.google.com (mail-pl1-x632.google.com [IPv6:2607:f8b0:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A32410F8 for ; Thu, 30 Nov 2023 12:12:24 -0800 (PST) Received: by mail-pl1-x632.google.com with SMTP id d9443c01a7336-1cfc3f50504so12637245ad.3 for ; Thu, 30 Nov 2023 12:12:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1701375143; x=1701979943; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=f0qCHVo7XzgiM/gOkeUKMtC009iJZbF6DLauLv10AR0=; b=OQ9rBmLHsdjdQ294mwxh7moyfDaokLIaUc1KpfSs9Ja/kLPTTSyqzZHbJqhIK77DME mC9T1C0MP5SECbGGKeeAMqq1fHoE2yJSxHoujE45USwHqx7NI2Wnpd6x3AyDEi9RUqxF VoZd3HAMZ9ZUK9XGjSxdSwCzxOuqHNwH33k90= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701375143; x=1701979943; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=f0qCHVo7XzgiM/gOkeUKMtC009iJZbF6DLauLv10AR0=; b=uZeKwdW0LDTR7qQsMEgmklTkJcBycx/+Uwh1u3H8E0Za/ZtHIKVaMfwrXMjQmA9Z+j cB9DzcRv/4Tjv+boPRptubsQoqlFnoIgo76gIQZQiIizZ8CNlxSWssr0xCHRqklPg41u GzzwPy9Gf/ExieSbYhkFhJ4U8lzkcnRIAgnAszYwLXf72kxf7hgiOCQSq+GSh3VS4cb1 BJT4XFgHeQAtfpePKh0jEtlngKfP14mtG2IW0u2eNAZjVFpi/EFRnlYA+m7TEPaOLYsz SWOfe9zFa11A7UC1CCb1eaHQmzzeSCZDajUkv4Y1oDQHWxIfnU1FmK6vyd3iCqYouHdg P8gA== X-Gm-Message-State: AOJu0YwHuCloo2wuO02ZIg41zv8bTstTqlrtHDCNxRZtkNvhnoDFuWGB Mt6CSMeU5TG/DUCAO1SRymgisw== X-Google-Smtp-Source: AGHT+IG7GB1EAs6x6BGig4Qdnq8J7tH7U+ck4TUN97KpzMVewKtuS3lBCHehX3Fj143SB3P6el4zJA== X-Received: by 2002:a17:902:be12:b0:1cf:9e9f:fddf with SMTP id r18-20020a170902be1200b001cf9e9ffddfmr22774377pls.44.1701375143633; Thu, 30 Nov 2023 12:12:23 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id v1-20020a1709029a0100b001cfb573674fsm1800131plp.30.2023.11.30.12.12.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Nov 2023 12:12:23 -0800 (PST) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Tejun Heo , Azeem Shaikh , Zefan Li , Johannes Weiner , Waiman Long , linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, bpf@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 1/3] kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy() Date: Thu, 30 Nov 2023 12:12:17 -0800 Message-Id: <20231130201222.3613535-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231130200937.it.424-kees@kernel.org> References: <20231130200937.it.424-kees@kernel.org> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1627; i=keescook@chromium.org; h=from:subject; bh=KaMikVVf9IlMYxhWSymwvYJ80Grx9jhkkXD92Gcwols=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBlaOyjg8fq+Kgz91M5MgN0iGKTEy9c1pTW6k2g3 Om7gwyq3vSJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZWjsowAKCRCJcvTf3G3A JvipD/9bZ1YWV76igC9fhSpnzKbHHp6551cCO3pInR0GeFHntgT5F19ANIOxgzmIBPsQZGJzh+S YT33if7BAW5mJS6SW0/JwpmKCMt8jUN5Dw4H+uwr/lSO2v1JBLUv65KaJHbKxOuKYhf/K8m+KeC G15UFTVEgDW8PCfT6tFshli/Pl5byyOhNZEAfR5ojzzeErfO0NoGkBPtn2kmyDnE1ttT+Eo1dZd bYa7mFWYeoYxpu2W/8DvsErrwskB2vYVPqSDoJrl2frQE+xkzNZCO5ru8Vjw7GXgE+t0DiYt8hg F7iw8uygmx11wG/5naWBwc/NsxsKeqPK6yeHqXtYWRU4ACZEC0D3eoa0n5sHaNjE9no1jRL5yub Br09TCk7VxJLPDv+qbH2QMY/ebs2zICGc+P+E04Ee8r3TuzfEI1NARDnNLfY0s2n9g6qy2jZYfy trVptzxRK9qS8DEBJtkRYr8LOD7nEwBM3xsmLANcgWYAcxDR4zGMlHRPuqg2YNHYqR5OGl4jEGq Y/a19aWEub4yvainVlv8qmZzWncVUktEIvBYR8tKuVcO6HxIlp9LsRTeTfYZsOmM5/EN1piG0yR RKr/6Sg6QBCZuCORc73txJPy9xzWq24oCIWbt3xq7SBvSQhoxYgbp9sJ/sTC4nO0ZlN0uBjgqTc gLWikxOalpnj9pA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated[1]. Additionally, it returns the size of the source string, not the resulting size of the destination string. In an effort to remove strlcpy() completely[2], replace strlcpy() here with strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1] Link: https://github.com/KSPP/linux/issues/89 [2] Cc: Greg Kroah-Hartman Cc: Tejun Heo Cc: Azeem Shaikh Link: https://lore.kernel.org/r/20231116192127.1558276-1-keescook@chromium.org Signed-off-by: Kees Cook --- fs/kernfs/dir.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index 8b2bd65d70e7..37353901ede1 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -850,16 +850,16 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent, const unsigned char *path, const void *ns) { - size_t len; + ssize_t len; char *p, *name; lockdep_assert_held_read(&kernfs_root(parent)->kernfs_rwsem); spin_lock_irq(&kernfs_pr_cont_lock); - len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf)); + len = strscpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf)); - if (len >= sizeof(kernfs_pr_cont_buf)) { + if (len < 0) { spin_unlock_irq(&kernfs_pr_cont_lock); return NULL; } From patchwork Thu Nov 30 20:12:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13474999 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="GtpZEhQ0" Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A05AE170F for ; Thu, 30 Nov 2023 12:12:25 -0800 (PST) Received: by mail-pl1-x62c.google.com with SMTP id d9443c01a7336-1cfc9c4acb6so13338375ad.0 for ; Thu, 30 Nov 2023 12:12:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1701375145; x=1701979945; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=OxiCx504yHLmFes8dR2H4gaz2egSElvJRBaPgOOtpHk=; b=GtpZEhQ0i3uv0aQzJhmOwj4huUqIWHViM7T9FWTkpBpiV5QlfizYMV7TJykNrUI+m3 Q6qB1l7mGoQFSLWuEFVtrSqxmxOLmc/DwWuA1L2IHmPDDYmhroqKlvypHwHr0whZ64/q 3B22eUh4TXmIM7UpcQOZhGY7opnxgPgx4CO0w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701375145; x=1701979945; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=OxiCx504yHLmFes8dR2H4gaz2egSElvJRBaPgOOtpHk=; b=v/dIPGXOWsGiHoYAncvAqX9Csw1YiZdMHfQYhMrjGZ4udqYwG+0x++xmu+ORPLVU0m 3ItlqbLM/3j4Sq4fCMwSHdRLMDKYg3OF8ZPaK4hwFh564JOHbRlwFNiiL/2G97XchrMi eniFznFquS6jTgiAa+aXgxKVgW3ZJDTqibqr5eFFjETNc2ftH7xkln4EdEpCrhvTTp89 wleVPP3VlRPEDOoGKP9cV6wodqZBwfodbEHHqY3ePz08W+YfpPQ+JFZtD0EzameJfchy oi2zVlzySGcdo5OtDGUiegS94hKTqT2BaYclnH6pN7g0D4VwFu9ZMZrAY1uE7oL3I2hO bSFQ== X-Gm-Message-State: AOJu0YxKyD5vJEZ52IPZHYv77u+wCTQah7zSfat+KobPItMnaRve9+3b r+vdlpz9YpSFRK7cAS/csloWRQ== X-Google-Smtp-Source: AGHT+IEGq93c/Iw/ZgddCDWopgpI+b7c8CTq5jVvTxu7Bu3lG3iJaOBkaRAMLQswM+i4fu1EBHU5yA== X-Received: by 2002:a17:903:228a:b0:1cf:b146:8101 with SMTP id b10-20020a170903228a00b001cfb1468101mr24098384plh.16.1701375145110; Thu, 30 Nov 2023 12:12:25 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id w20-20020a170902a71400b001d0242c0471sm1794719plq.224.2023.11.30.12.12.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Nov 2023 12:12:23 -0800 (PST) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Tejun Heo , Azeem Shaikh , Zefan Li , Johannes Weiner , Waiman Long , linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, bpf@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 2/3] kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy() Date: Thu, 30 Nov 2023 12:12:18 -0800 Message-Id: <20231130201222.3613535-2-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231130200937.it.424-kees@kernel.org> References: <20231130200937.it.424-kees@kernel.org> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2637; i=keescook@chromium.org; h=from:subject; bh=JAJdaxInWUYVNuwIwA8b/GPyHonLetqQSJoS2H+M0wM=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBlaOyjBNLwq83oMtldatGW+UhXwbgyaP8FTFySX SrtWyh/9ueJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZWjsowAKCRCJcvTf3G3A Jm5zEAClKw3heuKsLAxhXMgbSIvAPXK7qmEyDktGCUWVn1nRNWVFKPNbaM01zKM6050NbOlC/Dn uHrkNUwjUwO7nl6cOoI/ErwkWj2InKd2UEFHBUT6pyggumpGWZNGf2epzUNP3DCJzOeqisxmzmD uPN3+cV/yRUGoq6iq8EbLsxDUJSHugfyoLTcOWPwP8hKqBj4GPSNCFhpH5ZPEQCMqACjPOu75j+ 3+KwBNLt7nLsTn7ilAVoU6TeRmlmnv4tAcwJvyCnxMmAuDcDgUsqOwhYcgC8oaLVtrLq0iwDbvQ d2mJGliCeakISYslS0pxjlvSWeDJOByZqMADBLBuGZNR/s3UhTqI8drb12NldkzMm8D9JovJmMk pRdfjGXUFNyfN5DemTVLaAPtyVj+gTVMJADvEVjgsrq0VYa1aLze+oSJrdDC+zYUQwCdF45ov/w /tF0FwTz0byrsC+ytvYt0nw1i7ZdFuMoqoouLFMnPt5o3gpVcwcDFeT9y39usX08lUVfbsCKskj NbbDSDRzieaHqFBWAs+hFF8O3E02Kk+Y9moy6eang5KQgS3ahdWwW3WDKuygWRZ/ZT4kTh4ECN6 AF8ycj65cPRGIh1uBMGlaLk5MNeGMk07XH5aiPhWTCHOuGSqnzeFqy6MCC8VAisSJ2ZCeEBWPVt 71IQ/lmUUzgov6Q== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated[1]. Additionally, it returns the size of the source string, not the resulting size of the destination string. In an effort to remove strlcpy() completely[2], replace strlcpy() here with strscpy(). Nothing actually checks the return value coming from kernfs_name_locked(), so this has no impact on error paths. The caller hierarchy is: kernfs_name_locked() kernfs_name() pr_cont_kernfs_name() return value ignored cgroup_name() current_css_set_cg_links_read() return value ignored print_page_owner_memcg() return value ignored Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1] Link: https://github.com/KSPP/linux/issues/89 [2] Cc: Greg Kroah-Hartman Cc: Tejun Heo Cc: Azeem Shaikh Link: https://lore.kernel.org/r/20231116192127.1558276-2-keescook@chromium.org Signed-off-by: Kees Cook --- fs/kernfs/dir.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index 37353901ede1..8c0e5442597e 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -54,9 +54,9 @@ static bool kernfs_lockdep(struct kernfs_node *kn) static int kernfs_name_locked(struct kernfs_node *kn, char *buf, size_t buflen) { if (!kn) - return strlcpy(buf, "(null)", buflen); + return strscpy(buf, "(null)", buflen); - return strlcpy(buf, kn->parent ? kn->name : "/", buflen); + return strscpy(buf, kn->parent ? kn->name : "/", buflen); } /* kernfs_node_depth - compute depth from @from to @to */ @@ -182,12 +182,12 @@ static int kernfs_path_from_node_locked(struct kernfs_node *kn_to, * @buflen: size of @buf * * Copies the name of @kn into @buf of @buflen bytes. The behavior is - * similar to strlcpy(). + * similar to strscpy(). * * Fills buffer with "(null)" if @kn is %NULL. * - * Return: the length of @kn's name and if @buf isn't long enough, - * it's filled up to @buflen-1 and nul terminated. + * Return: the resulting length of @buf. If @buf isn't long enough, + * it's filled up to @buflen-1 and nul terminated, and returns -E2BIG. * * This function can be called from any context. */ From patchwork Thu Nov 30 20:12:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13475000 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="M6KzEFPj" Received: from mail-pf1-x42e.google.com (mail-pf1-x42e.google.com [IPv6:2607:f8b0:4864:20::42e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16BA91710 for ; Thu, 30 Nov 2023 12:12:26 -0800 (PST) Received: by mail-pf1-x42e.google.com with SMTP id d2e1a72fcca58-6cdd584591eso1366805b3a.2 for ; Thu, 30 Nov 2023 12:12:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1701375145; x=1701979945; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3IEJcj+02yasaKEUc42BotZapgbr+U+1GTgkYNrat/0=; b=M6KzEFPj1ASFT9ypGtIUDfUdu//+jEiRO2GNgJ9yr2GxKLeZ15pwnSvgE0PfPnzmFz eX1WjXFhr+d/gXmfeXh5OaCVJetULE8LCPUIgiLayZcysTu1fKwUPEwibGNXrSpVw1Ub EtcAFKFwC1BP6qI4yXM+/YzK9h5WFZY43ucZU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701375145; x=1701979945; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3IEJcj+02yasaKEUc42BotZapgbr+U+1GTgkYNrat/0=; b=g4z0owJT29VzDO5ZFVrgldrUjA200aZzsHipLKqU3YlMOmIuLzxpDXheV4Mx1Xvzt5 P8GzINxnOoX6MTwQi1MWtvsRfL5X+mj1cblS4bjVCqdZdozTc16U9BYfSJs0+mzqNGBt oX5rVnaej0rTQaZqDPPmmRl84EPs61k2SD/IVBWCsOByNLf+v7Fvk1xuAZZG/0uulVkv ZAXpAUZV9xQNZucfNcU4LX0zUT/TlokmdMjA+79UADrIMnlWspGWjCQFJI6JDw6EDok9 ePc+eGdJC4jukFvWWBvlppxp3vWFs2K4LtwJbCLfAp/QMQNP601mn5zcRLOmY+lTDDAu YApQ== X-Gm-Message-State: AOJu0YyQi7m7jNa7gK8zGkHRj9kTu1LdiLF+I9LSxjOjeIzsT+aPaNBV 9erT6zJs0M3YjLwsDZiBo5imbIuqfctQrO+umEg= X-Google-Smtp-Source: AGHT+IGmS512gLfjsiC23DOsNKs0FlGwweZbgWh3YqWfge+zfCU0ht7v1xSRmXV1rEL8ZTHooy6pjQ== X-Received: by 2002:a05:6a20:7350:b0:18d:4821:f754 with SMTP id v16-20020a056a20735000b0018d4821f754mr2376838pzc.55.1701375145632; Thu, 30 Nov 2023 12:12:25 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id n7-20020a170902d2c700b001cc52ca2dfbsm1800902plc.120.2023.11.30.12.12.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Nov 2023 12:12:25 -0800 (PST) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Tejun Heo , Zefan Li , Johannes Weiner , Waiman Long , cgroups@vger.kernel.org, Azeem Shaikh , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 3/3] kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() Date: Thu, 30 Nov 2023 12:12:19 -0800 Message-Id: <20231130201222.3613535-3-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231130200937.it.424-kees@kernel.org> References: <20231130200937.it.424-kees@kernel.org> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=8106; i=keescook@chromium.org; h=from:subject; bh=ytYczlvWwngfOAhKBEd29zggKM1dZYUFgsNew6TNfcc=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBlaOyjjwlnfJ6o+rRxKIqAd0jCo71AoDJUjPpjY YoJBoDBvPWJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZWjsowAKCRCJcvTf3G3A JkPUD/90GudFsO1LYNdR1bciTGcerJiWBv2OIofG6858EQVJUxJIy77PoKrYXozBwoPcfnsC+GD zy7am0RcN4EDnQdqH8l+VezpYkFjVdhE3VTSEGyD37n5L90dTTf4Ko7u6pC+fWt0db5mTotni+L ozR/VRxweZuhlkxvb3pvfmBUF3qrnomBRIs6T3FFK3iy87pwtW7dDKpHs+AZNfopDZIrdxaXmGL H9yEGTdMxCk7RqGWS8ZPJBtMLtUuEGDmwpCiC9KcxIhMnKPx8J05OLUXizl38IrKn1me65Rqivv UUpZolnF6jUmpNvKLG/kn0KCZAqtZm74QZFet4VH/k+qsHfZv+gG5oBVDHUcuwhWrSbiTYEjRoH GoSqPQE4lwwx3p1I0xUa9samPc/0lnKVbi5O6TIIxjAa4HmO/KTDFOnZCHmbGJUfbjvMzKVEK9Y tJpiiqkWffLMWl4QrwD8+ws8E5HP3l3hRX6o58VH64Nb3hV8jlvZlt8tCKreY+gRsRNedQVvNgZ aOL8Tr7PqUhRqe95IHxKpun7DKTZrM6+0hWER/rHNQqtfIJueAMQMOrPyHwklNqZajUEjLr1UHe 32zNNc/W45HOmSB32VYD2gHGvlwnS1+jONUOIj9zOxZVr0hT9NMwZbKeW65j/9nD+WsAZdPHoFx MLC/0IKHoha7fNA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 One of the last remaining users of strlcpy() in the kernel is kernfs_path_from_node_locked(), which passes back the problematic "length we _would_ have copied" return value to indicate truncation. Convert the chain of all callers to use the negative return value (some of which already doing this explicitly). All callers were already also checking for negative return values, so the risk to missed checks looks very low. In this analysis, it was found that cgroup1_release_agent() actually didn't handle the "too large" condition, so this is technically also a bug fix. :) Here's the chain of callers, and resolution identifying each one as now handling the correct return value: kernfs_path_from_node_locked() kernfs_path_from_node() pr_cont_kernfs_path() returns void kernfs_path() sysfs_warn_dup() return value ignored cgroup_path() blkg_path() bfq_bic_update_cgroup() return value ignored TRACE_IOCG_PATH() return value ignored TRACE_CGROUP_PATH() return value ignored perf_event_cgroup() return value ignored task_group_path() return value ignored damon_sysfs_memcg_path_eq() return value ignored get_mm_memcg_path() return value ignored lru_gen_seq_show() return value ignored cgroup_path_from_kernfs_id() return value ignored cgroup_show_path() already converted "too large" error to negative value cgroup_path_ns_locked() cgroup_path_ns() bpf_iter_cgroup_show_fdinfo() return value ignored cgroup1_release_agent() wasn't checking "too large" error proc_cgroup_show() already converted "too large" to negative value Cc: Greg Kroah-Hartman Cc: Tejun Heo Cc: Zefan Li Cc: Johannes Weiner Cc: Waiman Long Cc: cgroups@vger.kernel.org Co-developed-by: Azeem Shaikh Signed-off-by: Azeem Shaikh Link: https://lore.kernel.org/r/20231116192127.1558276-3-keescook@chromium.org Signed-off-by: Kees Cook --- fs/kernfs/dir.c | 37 ++++++++++++++++++++----------------- kernel/cgroup/cgroup-v1.c | 2 +- kernel/cgroup/cgroup.c | 4 ++-- kernel/cgroup/cpuset.c | 2 +- 4 files changed, 24 insertions(+), 21 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index 8c0e5442597e..183f353b3852 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -127,7 +127,7 @@ static struct kernfs_node *kernfs_common_ancestor(struct kernfs_node *a, * * [3] when @kn_to is %NULL result will be "(null)" * - * Return: the length of the full path. If the full length is equal to or + * Return: the length of the constructed path. If the path would have been * greater than @buflen, @buf contains the truncated path with the trailing * '\0'. On error, -errno is returned. */ @@ -138,16 +138,17 @@ static int kernfs_path_from_node_locked(struct kernfs_node *kn_to, struct kernfs_node *kn, *common; const char parent_str[] = "/.."; size_t depth_from, depth_to, len = 0; + ssize_t copied; int i, j; if (!kn_to) - return strlcpy(buf, "(null)", buflen); + return strscpy(buf, "(null)", buflen); if (!kn_from) kn_from = kernfs_root(kn_to)->kn; if (kn_from == kn_to) - return strlcpy(buf, "/", buflen); + return strscpy(buf, "/", buflen); common = kernfs_common_ancestor(kn_from, kn_to); if (WARN_ON(!common)) @@ -158,18 +159,22 @@ static int kernfs_path_from_node_locked(struct kernfs_node *kn_to, buf[0] = '\0'; - for (i = 0; i < depth_from; i++) - len += strlcpy(buf + len, parent_str, - len < buflen ? buflen - len : 0); + for (i = 0; i < depth_from; i++) { + copied = strscpy(buf + len, parent_str, buflen - len); + if (copied < 0) + return copied; + len += copied; + } /* Calculate how many bytes we need for the rest */ for (i = depth_to - 1; i >= 0; i--) { for (kn = kn_to, j = 0; j < i; j++) kn = kn->parent; - len += strlcpy(buf + len, "/", - len < buflen ? buflen - len : 0); - len += strlcpy(buf + len, kn->name, - len < buflen ? buflen - len : 0); + + copied = scnprintf(buf + len, buflen - len, "/%s", kn->name); + if (copied < 0) + return copied; + len += copied; } return len; @@ -214,7 +219,7 @@ int kernfs_name(struct kernfs_node *kn, char *buf, size_t buflen) * path (which includes '..'s) as needed to reach from @from to @to is * returned. * - * Return: the length of the full path. If the full length is equal to or + * Return: the length of the constructed path. If the path would have been * greater than @buflen, @buf contains the truncated path with the trailing * '\0'. On error, -errno is returned. */ @@ -265,12 +270,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn) sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf)); if (sz < 0) { - pr_cont("(error)"); - goto out; - } - - if (sz >= sizeof(kernfs_pr_cont_buf)) { - pr_cont("(name too long)"); + if (sz == -E2BIG) + pr_cont("(name too long)"); + else + pr_cont("(error)"); goto out; } diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 76db6c67e39a..9cb00ebe9ac6 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -802,7 +802,7 @@ void cgroup1_release_agent(struct work_struct *work) goto out_free; ret = cgroup_path_ns(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns); - if (ret < 0 || ret >= PATH_MAX) + if (ret < 0) goto out_free; argv[0] = agentbuf; diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4b9ff41ca603..8d2674c6aaef 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -1893,7 +1893,7 @@ int cgroup_show_path(struct seq_file *sf, struct kernfs_node *kf_node, len = kernfs_path_from_node(kf_node, ns_cgroup->kn, buf, PATH_MAX); spin_unlock_irq(&css_set_lock); - if (len >= PATH_MAX) + if (len == -E2BIG) len = -ERANGE; else if (len > 0) { seq_escape(sf, buf, " \t\n\\"); @@ -6301,7 +6301,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns, if (cgroup_on_dfl(cgrp) || !(tsk->flags & PF_EXITING)) { retval = cgroup_path_ns_locked(cgrp, buf, PATH_MAX, current->nsproxy->cgroup_ns); - if (retval >= PATH_MAX) + if (retval == -E2BIG) retval = -ENAMETOOLONG; if (retval < 0) goto out_unlock; diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 615daaf87f1f..fb29158ae825 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -4941,7 +4941,7 @@ int proc_cpuset_show(struct seq_file *m, struct pid_namespace *ns, retval = cgroup_path_ns(css->cgroup, buf, PATH_MAX, current->nsproxy->cgroup_ns); css_put(css); - if (retval >= PATH_MAX) + if (retval == -E2BIG) retval = -ENAMETOOLONG; if (retval < 0) goto out_free;