Re: [PATCH] asm-generic: fix buffer overflow read in __strncpy_from_user

On Mon, Jun 27, 2022 at 9:40 AM Yangxi Xiang xyangxi5@gmail.com wrote:

I also noticed that it was removed in commit 98b861a30431. I did see this problem in kernel 5.1 and this problem remains in architectures without selecting config GENERIC_STRNCPY_FROM_USER.

Which architectures do you mean? I don't see any architecture using asm-generic/uaccess.h without setting GENERIC_STRNCPY_FROM_USER before commit 98b861a30431 or the prior release.

Also, I think the implementation relied on strncpy() setting a zero pad at the end of the string, so the ckeck would only be needed for a count value that starts out negative? Is there another way this can actually cause problems?

Arnd