Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 24 Jul 2023 16:44:38 -0700
From:   Kees Cook <kees@kernel.org>
To:     sel4@tilde.club
CC:     keescook@chromium.org, Brandon Luo <sel4@tilde.club>,
        syzbot+98d3ceb7e01269e7bf4f@syzkaller.appspotmail.com,
        syzbot+155274e882dcbf9885df@syzkaller.appspotmail.com,
        linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: =?US-ASCII?Q?Re=3A_=5BPATCH=5D_fortify=3A_strnl?= =?US-ASCII?Q?en=3A_Call_fortify=5Fpanic=28=29_on?= =?US-ASCII?Q?ly_if_the_number_of_bytes_read_is_greater_than_maxlen?=
User-Agent: K-9 Mail for Android
In-Reply-To: <20230724224857.2049906-1-sel4@tilde.club>
References: <4F5F9CC2-803C-4E18-968C-A46B32528F1F@kernel.org> <20230724224857.2049906-1-sel4@tilde.club>
Message-ID: <53423CC8-1A7E-4FD2-8F6B-83E88ABE30A5@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On July 24, 2023 3:48:57 PM PDT, sel4@tilde=2Eclub wrote:
>From: Brandon Luo <sel4@tilde=2Eclub>
>
>If the number of bytes read is p_size and p_size is less than maxlen,
>fortify_panic() will be called incorrectly=2E Only panic if the number of
>bytes read is greater than the minimum of p_size and maxlen since that is
> the argument to __real_strnlen()=2E
>
>Reported-by: syzbot+98d3ceb7e01269e7bf4f@syzkaller=2Eappspotmail=2Ecom
>Closes: https://lore=2Ekernel=2Eorg/all/000000000000d8352e0600c0c804@goog=
le=2Ecom/
>
>Reported-by: syzbot+155274e882dcbf9885df@syzkaller=2Eappspotmail=2Ecom
>Closes: https://lore=2Ekernel=2Eorg/all/000000000000de4c2c0600c02b28@goog=
le=2Ecom/

Thanks for looking at these, but strnlen is working correctly=2E The probl=
em was hfs's overread of a cast be32 when used with strscpy=2E See:
https://lore=2Ekernel=2Eorg/lkml/202307182147=2EA5B81B67D@keescook/

-Kees

>
>Signed-off-by: Brandon Luo <sel4@tilde=2Eclub>
>---
> include/linux/fortify-string=2Eh | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/include/linux/fortify-string=2Eh b/include/linux/fortify-str=
ing=2Eh
>index da51a83b2829=2E=2Ecde637f735fe 100644
>--- a/include/linux/fortify-string=2Eh
>+++ b/include/linux/fortify-string=2Eh
>@@ -176,8 +176,9 @@ __FORTIFY_INLINE __kernel_size_t strnlen(const char *=
 const POS p, __kernel_size
> 	}
>=20
> 	/* Do not check characters beyond the end of p=2E */
>-	ret =3D __real_strnlen(p, maxlen < p_size ? maxlen : p_size);
>-	if (p_size <=3D ret && maxlen !=3D ret)
>+	maxlen =3D (maxlen < p_size) ? maxlen : p_size;
>+	ret =3D __real_strnlen(p, maxlen);
>+	if (maxlen < ret)
> 		fortify_panic(__func__);
> 	return ret;
> }


--=20
Kees Cook