linux-hardening.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Kees Cook <keescook@chromium.org>
Cc: "Len Baker" <len.baker@gmx.com>,
	"Russell King (Oracle)" <linux@armlinux.org.uk>,
	"Lee Jones" <lee.jones@linaro.org>,
	"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>,
	linux-hardening@vger.kernel.org, linux-input@vger.kernel.org,
	linux-kernel@vger.kernel.org, "Joe Perches" <joe@perches.com>
Subject: Re: [PATCH] drivers/input: Remove all strcpy() uses in favor of strscpy()
Date: Sun, 1 Aug 2021 10:19:07 -0700	[thread overview]
Message-ID: <YQbXiwie4YPzPWKK@google.com> (raw)
In-Reply-To: <202108010934.FA668DEB28@keescook>

On Sun, Aug 01, 2021 at 09:44:33AM -0700, Kees Cook wrote:
> On Sun, Aug 01, 2021 at 05:57:32PM +0200, Len Baker wrote:
> > Hi,
> > 
> > On Sun, Aug 01, 2021 at 04:00:00PM +0100, Russell King (Oracle) wrote:
> > > On Sun, Aug 01, 2021 at 04:43:16PM +0200, Len Baker wrote:
> > > > strcpy() performs no bounds checking on the destination buffer. This
> > > > could result in linear overflows beyond the end of the buffer, leading
> > > > to all kinds of misbehaviors. The safe replacement is strscpy().
> > > >
> > > > Signed-off-by: Len Baker <len.baker@gmx.com>
> > > > ---
> > > > This is a task of the KSPP [1]
> > > >
> > > > [1] https://github.com/KSPP/linux/issues/88
> > > >
> > > >  drivers/input/keyboard/locomokbd.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/input/keyboard/locomokbd.c b/drivers/input/keyboard/locomokbd.c
> > > > index dae053596572..dbb3dc48df12 100644
> > > > --- a/drivers/input/keyboard/locomokbd.c
> > > > +++ b/drivers/input/keyboard/locomokbd.c
> > > > @@ -254,7 +254,7 @@ static int locomokbd_probe(struct locomo_dev *dev)
> > > >  	locomokbd->suspend_jiffies = jiffies;
> > > >
> > > >  	locomokbd->input = input_dev;
> > > > -	strcpy(locomokbd->phys, "locomokbd/input0");
> > > > +	strscpy(locomokbd->phys, "locomokbd/input0", sizeof(locomokbd->phys));
> > >
> > > So if the string doesn't fit, it's fine to silently truncate it?
> > 
> > I think it is better than overflow :)
> > 
> > > Rather than converting every single strcpy() in the kernel to
> > > strscpy(), maybe there should be some consideration given to how the
> > > issue of a strcpy() that overflows the buffer should be handled.
> > > E.g. in the case of a known string such as the above, if it's longer
> > > than the destination, should we find a way to make the compiler issue
> > > a warning at compile time?
> > 
> > Good point. I am a kernel newbie and have no experience. So this
> > question should be answered by some kernel hacker :) But I agree
> > with your proposals.
> > 
> > Kees and folks: Any comments?
> > 
> > Note: Kees is asked the same question in [2]
> > 
> > [2] https://lore.kernel.org/lkml/20210731135957.GB1979@titan/
> 
> Hi!
> 
> Sorry for the delay at looking into this. It didn't use to be a problem
> (there would always have been a compile-time warning generated for
> known-too-small cases), but that appears to have regressed when,
> ironically, strscpy() coverage was added. I've detailed it in the bug
> report:
> https://github.com/KSPP/linux/issues/88
> 
> So, bottom line: we need to fix the missing compile-time warnings for
> strcpy() and strscpy() under CONFIG_FORTIFY_SOURCE=y.

Is it possible to have them warn always? Or that would be too many false
positives?

> 
> In the past we'd tried to add a stracpy()[1] that would only work with
> const string sources. Linus got angry[2] about API explosion, though,
> so we're mostly faced with doing the strscpy() replacements.

I would like to have an API that would do compile-time checks and
BUILD_BUG_ON() for a few places in input drivers where we copy constant
strings. There is no reason to encumber the code with runtime checks,
and bombing out on compile instead of truncating would be nice.

> 
> Another idea might be to have strcpy() do the "constant strings only"
> thing, leaving strscpy() for the dynamic lengths.
> 
> One thing is clear: replacing strlcpy() with strscpy() is probably the
> easiest and best first step to cleaning up the proliferation of str*()
> functions.

OK, so the consensus is that we set this patch aside as it does not
really fix any issues (the strcpy() destination is 32 bytes and is big
enough to hold the string being copied)?

Thanks.

-- 
Dmitry

  reply	other threads:[~2021-08-01 17:19 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-01 14:43 Len Baker
2021-08-01 15:00 ` Russell King (Oracle)
2021-08-01 15:57   ` Len Baker
2021-08-01 16:44     ` Kees Cook
2021-08-01 17:19       ` Dmitry Torokhov [this message]
2021-08-02 16:17         ` Kees Cook
2021-08-03  7:07       ` Kees Cook
2021-08-03  7:18         ` Hans Verkuil
2021-08-07 14:02       ` Len Baker
2021-08-07 15:17         ` Joe Perches
2021-08-08 11:30           ` Len Baker
2021-08-01 16:39   ` Joe Perches
2021-08-01 16:55     ` Joe Perches
2021-08-02 16:13       ` Kees Cook
2021-08-02 18:57         ` Joe Perches
2021-08-07 14:10           ` Len Baker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YQbXiwie4YPzPWKK@google.com \
    --to=dmitry.torokhov@gmail.com \
    --cc=joe@perches.com \
    --cc=keescook@chromium.org \
    --cc=lee.jones@linaro.org \
    --cc=len.baker@gmx.com \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@armlinux.org.uk \
    --cc=u.kleine-koenig@pengutronix.de \
    --subject='Re: [PATCH] drivers/input: Remove all strcpy() uses in favor of strscpy()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).