Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20200626130525.389469-1-lee.jones@linaro.org> <20200626130525.389469-2-lee.jones@linaro.org>
In-Reply-To: <20200626130525.389469-2-lee.jones@linaro.org>
From:   Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Mon, 13 Jul 2020 21:10:51 +0200
Message-ID: <CAMuHMdVaO3gABJxRzBL+2U9axfAuBLRghSY0vCc9f8a6huiYZg@mail.gmail.com>
Subject: Re: [PATCH 01/10] misc: c2port: core: Ensure source size does not
 equal destination size in strncpy()
To:     Lee Jones <lee.jones@linaro.org>
Cc:     Arnd Bergmann <arnd@arndb.de>,
        Greg KH <gregkh@linuxfoundation.org>,
        "Eurotech S.p.A" <info@eurotech.it>,
        Rodolfo Giometti <giometti@linux.it>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Linux ARM <linux-arm-kernel@lists.infradead.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8BIT
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Lee,

On Fri, Jun 26, 2020 at 3:06 PM Lee Jones <lee.jones@linaro.org> wrote:
> We need to ensure there's a place for the NULL terminator.

But who's filling that space with a NUL (not NULL) terminator?

> Fixes the following W=1 warning(s):
>
>  In file included from include/linux/bitmap.h:9,
>  from include/linux/nodemask.h:95,
>  from include/linux/mmzone.h:17,
>  from include/linux/gfp.h:6,
>  from include/linux/umh.h:4,
>  from include/linux/kmod.h:9,
>  from include/linux/module.h:16,
>  from drivers/misc/c2port/core.c:9:
>  In function ‘strncpy’,
>  inlined from ‘c2port_device_register’ at drivers/misc/c2port/core.c:926:2:
>  include/linux/string.h:297:30: warning: ‘__builtin_strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
>  297 | #define __underlying_strncpy __builtin_strncpy
>  | ^
>  include/linux/string.h:307:9: note: in expansion of macro ‘__underlying_strncpy’
>  307 | return __underlying_strncpy(p, q, size);
>  | ^~~~~~~~~~~~~~~~~~~~
>
> Cc: Rodolfo Giometti <giometti@linux.it>
> Cc: "Eurotech S.p.A" <info@eurotech.it>
> Signed-off-by: Lee Jones <lee.jones@linaro.org>
> ---
>  drivers/misc/c2port/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
> index 33bba18022892..80d87e8a0bea9 100644
> --- a/drivers/misc/c2port/core.c
> +++ b/drivers/misc/c2port/core.c
> @@ -923,7 +923,7 @@ struct c2port_device *c2port_device_register(char *name,
>         }
>         dev_set_drvdata(c2dev->dev, c2dev);

c2dev is allocated using:

        c2dev = kmalloc(sizeof(struct c2port_device), GFP_KERNEL);

hence the allocated memory is not zeroed.

>
> -       strncpy(c2dev->name, name, C2PORT_NAME_LEN);
> +       strncpy(c2dev->name, name, C2PORT_NAME_LEN - 1);

strncpy()
  1. does not terminate the destination with a NUL if the source length
      is C2PORT_NAME_LEN - 1,
  2. fills all remaining space in the destination buffer with NUL characters.

So c2dev.name[C2PORT_NAME_LEN - 1] always contains an uninitialized
value.

Now, it seems the only caller of c2port_device_register() passes
"uc" as the name.  Which means in practice c2dev.name[] will be
NUL-terminated. However, the last byte will still be uninitialized, and
if the buffer is ever copied to userspace, your patch will have introduced
a leak.

>         c2dev->ops = ops;
>         mutex_init(&c2dev->mutex);

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds