• Kees Cook's avatar
    SUNRPC: Replace strlcpy() with strscpy() · cb6d2fd3
    Kees Cook authored
    strlcpy() reads the entire source buffer first. This read may exceed
    the destination size limit. This is both inefficient and can lead
    to linear read overflows if a source string is not NUL-terminated[1].
    Additionally, it returns the size of the source string, not the
    resulting size of the destination string. In an effort to remove strlcpy()
    completely[2], replace strlcpy() here with strscpy().
    
    Explicitly handle the truncation case by returning the size of the
    resulting string.
    
    If "nodename" was ever longer than sizeof(clnt->cl_nodename) - 1, this
    change will fix a bug where clnt->cl_nodelen would end up thinking there
    were more characters in clnt->cl_nodename than there actually were,
    which might have lead to kernel memory content exposures.
    
    Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
    Cc: Anna Schumaker <anna@kernel.org>
    Cc: Chuck Lever <chuck.lever@oracle.com>
    Cc: Jeff Layton <jlayton@kernel.org>
    Cc: Neil Brown <neilb@suse.de>
    Cc: Olga Kornievskaia <kolga@netapp.com>
    Cc: Dai Ngo <Dai.Ngo@oracle.com>
    Cc: Tom Talpey <tom@talpey.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Jakub Kicinski <kuba@kernel.org>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Cc: linux-nfs@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1]
    Link: https://github.com/KSPP/linux/issues/89 [2]
    Co-developed-by: default avatarAzeem Shaikh <azeemshaikh38@gmail.com>
    Signed-off-by: default avatarAzeem Shaikh <azeemshaikh38@gmail.com>
    Reviewed-by: default avatarNeilBrown <neilb@suse.de>
    Link: https://lore.kernel.org/r/20231114175407.work.410-kees@kernel.orgSigned-off-by: default avatarKees Cook <keescook@chromium.org>
    cb6d2fd3
clnt.c 79.9 KB