Files
linux/lib
Mark Rutland 7af6188c36 BACKPORT: lib: harden strncpy_from_user
The strncpy_from_user() accessor is effectively a copy_from_user()
specialised to copy strings, terminating early at a NUL byte if possible.
In other respects it is identical, and can be used to copy an arbitrarily
large buffer from userspace into the kernel.  Conceptually, it exposes a
similar attack surface.

As with copy_from_user(), we check the destination range when the kernel
is built with KASAN, but unlike copy_from_user() we do not check the
destination buffer when using HARDENED_USERCOPY.  As strncpy_from_user()
calls get_user() in a loop, we must call check_object_size() explicitly.

This patch adds this instrumentation to strncpy_from_user(), per the same
rationale as with the regular copy_from_user().  In the absence of
hardened usercopy this will have no impact as the instrumentation expands
to an empty static inline function.

Link: http://lkml.kernel.org/r/1472221903-31181-1-git-send-email-mark.rutland@arm.com
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Bug: 31374226
Change-Id: I898e4e9f19307e37a9be497cb1a0d7f1e3911661
(cherry picked from commit bf90e56e46)
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2016-10-18 11:08:46 -07:00
..
2014-10-09 11:35:48 +03:00
2015-07-27 14:06:24 +02:00
2011-03-11 14:25:50 +00:00
2015-11-23 09:44:58 +01:00
2015-05-28 11:31:52 +09:30
2011-10-29 21:20:22 +02:00
2006-06-25 10:01:20 -07:00
2006-06-25 10:01:20 -07:00
2015-10-05 04:49:54 +01:00
2015-11-09 15:11:24 -08:00
2014-04-30 19:49:37 +01:00
2012-10-06 03:04:57 +09:00
2014-08-06 18:01:25 -07:00
2014-05-05 09:09:14 +02:00
2014-08-08 15:57:25 -07:00
2015-07-28 08:50:42 +01:00
2015-02-12 18:54:15 -08:00
2012-07-30 17:25:16 -07:00
2014-06-25 17:45:43 -07:00
2015-02-12 18:54:16 -08:00
2015-03-23 22:12:08 -04:00
2015-06-25 17:00:40 -07:00
2013-04-29 18:28:42 -07:00