MIME-Version: 1.0
In-Reply-To: <a67a79a6-5397-abc2-f222-bb4cb62ee6e3@virtuozzo.com>
References: <20171207113324.24388-1-eguan@redhat.com> <CAGXu5jKji0Kvp0CL1YJT6oCqxPa2KfdhMD_Pi8oAnpwMc_sXLw@mail.gmail.com>
 <9f0a9cf6-51f7-cd1f-5dc6-6d510a7b8ec4@virtuozzo.com> <CACT4Y+YGacuRHOSM1r0+FQNMg2PcLgvUYTUTX9sS9NSqE3dYBQ@mail.gmail.com>
 <CAGXu5jJdD5u7fNd2Pnbv77fJwgCvZmOVxQLketMj5PuWs5Q1Tg@mail.gmail.com>
 <46584b52-f2f2-a602-1ae6-cfa0e321324a@virtuozzo.com> <2a9ca72e28ba44198f07f4e412970ad9@AcuMS.aculab.com>
 <a67a79a6-5397-abc2-f222-bb4cb62ee6e3@virtuozzo.com>
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 12 Dec 2017 14:42:51 -0800
Message-ID: <CA+55aFzmhPFPtDtY4ZY6=yCBFizUJJjacmWREyJvt17V_cmTug@mail.gmail.com>
Subject: Re: [PATCH] lib/string: avoid reading beyond src buffer in strscpy
To: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: David Laight <David.Laight@aculab.com>,
        Kees Cook <keescook@chromium.org>, Dmitry Vyukov <dvyukov@google.com>,
        Eryu Guan <eguan@redhat.com>, LKML <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Chris Metcalf <cmetcalf@ezchip.com>,
        Alexander Potapenko <glider@google.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 590
Lines: 18

On Tue, Dec 12, 2017 at 8:06 AM, Andrey Ryabinin
<aryabinin@virtuozzo.com> wrote:
>
> See for yourself, strscpy() is the only sting function doing this.

No, strnlen_user() definitely does too.

It's just that KASAN doesn't track user pointers.

And the important strlen() in the kernel is the pathname hashing code,
which *definitely* accesses outside the source, but since it can
actually traverse to another page we have that one annotated too (with
load_unaligned_zeropad()).

So no, strscpy() isn't the only one doing it, it is just the only one
that KASAN catches.

            Linus