From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752822AbdHIUje (ORCPT ); Wed, 9 Aug 2017 16:39:34 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:44016 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752114AbdHIUjc (ORCPT ); Wed, 9 Aug 2017 16:39:32 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chris Metcalf Subject: [PATCH 3.18 18/92] strscpy: zero any trailing garbage bytes in the destination Date: Wed, 9 Aug 2017 13:36:46 -0700 Message-Id: <20170809202156.235812568@linuxfoundation.org> X-Mailer: git-send-email 2.14.0 In-Reply-To: <20170809202155.435709888@linuxfoundation.org> References: <20170809202155.435709888@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Metcalf commit 990486c8af044f89bddfbde1d1cf9fde449bedbf upstream. It's possible that the destination can be shadowed in userspace (as, for example, the perf buffers are now). So we should take care not to leak data that could be inspected by userspace. Signed-off-by: Chris Metcalf Signed-off-by: Greg Kroah-Hartman --- lib/string.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/lib/string.c +++ b/lib/string.c @@ -211,12 +211,13 @@ ssize_t strscpy(char *dest, const char * unsigned long c, data; c = *(unsigned long *)(src+res); - *(unsigned long *)(dest+res) = c; if (has_zero(c, &data, &constants)) { data = prep_zero_mask(c, data, &constants); data = create_zero_mask(data); + *(unsigned long *)(dest+res) = c & zero_bytemask(data); return res + find_zero(data); } + *(unsigned long *)(dest+res) = c; res += sizeof(unsigned long); count -= sizeof(unsigned long); max -= sizeof(unsigned long);