From patchwork Tue Aug 8 22:48:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Justin Stitt X-Patchwork-Id: 133005 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:c44e:0:b0:3f2:4152:657d with SMTP id w14csp2495703vqr; Tue, 8 Aug 2023 18:16:51 -0700 (PDT) X-Google-Smtp-Source: AGHT+IG4rOYF+7um6mEkxryIE8qNodxgq5lGZrli2eH0xa8Zywchcb0KUSYwItw2szFBRuarO+AU X-Received: by 2002:a05:6a21:6da0:b0:13d:7432:ed63 with SMTP id wl32-20020a056a216da000b0013d7432ed63mr1340919pzb.8.1691543811006; Tue, 08 Aug 2023 18:16:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691543810; cv=none; d=google.com; s=arc-20160816; b=Qtt7mED3Os4s7HLkgRgZGg5wAXd2lbY2QgC9LDulUN3nf9MVyPfz5jlVCnhWW063y6 +EznW4bUls8NS39R/nPAetpzjpei5z+5Yz/uMXr71b8Fuv7cXJKo8G6b/8kO1K2X9mmV 2cspDAim6qx+4eZVI8zq74YUdXVrQhJ7dRDAQMiLQOKX7eZqK7DDDM1n2g7wLh1YZiT6 x+muV8QuQwT2FQeoVkcbdGL84K5tZfkWCterP/Y61A9oQH0NiVBraGKOJ5dpflg6X+nT XdLxHGT4+AFHpgOdD+gwlupOm5oVjlhmemrOd8N3qLQzFh9eREYq79a74/rZAajY81TA Qrfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:dkim-signature; bh=2n+nft1J+ou/Hn4BoHtSydnM2Q6o7LrROT4GXzieyqk=; fh=XKPrIMXRcymmuVm42EqALpL6e4c/4tr+JJaDiplPt4I=; b=B8mkXw2YjTnQ0bhnPWdfqeHZ1OW0kgxpKeig0fp33cgS6TfHBsy0S/fSfKPRHNrkyw SFX61Pq3E0Wj7GbdMpLfILThHmQYe4itrRFmR7M7B8twYOTrUslc0XSKFaGlt4AIRIBQ LD4c4t0nDVE7cs1U7QJ5MJOCPNxFAK1jbzGj+kJKRQreGLm+Ndrujt2yxn5CVSeygWyp VLgi3ZIPEOWoSiwHZEzhFfRViXvS8jsxzluXbPqjRBY0+wTNzQdCZExQDr4kpBJBv7+X qZ+nAD4DJZPZhVonAlMKNjhg3DrBl0ct+O/VIPIcwcQGZ7BxuEt3C6UnO/tQ/29e3T00 d5tA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b=Z4tv8uuX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d14-20020a170903230e00b001b3c63eba76si8540387plh.492.2023.08.08.18.16.39; Tue, 08 Aug 2023 18:16:50 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b=Z4tv8uuX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231535AbjHHWsl (ORCPT + 99 others); Tue, 8 Aug 2023 18:48:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47522 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230173AbjHHWsh (ORCPT ); Tue, 8 Aug 2023 18:48:37 -0400 Received: from mail-oo1-xc49.google.com (mail-oo1-xc49.google.com [IPv6:2607:f8b0:4864:20::c49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B5D2114 for ; Tue, 8 Aug 2023 15:48:36 -0700 (PDT) Received: by mail-oo1-xc49.google.com with SMTP id 006d021491bc7-565893ef956so8901215eaf.0 for ; Tue, 08 Aug 2023 15:48:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691534915; x=1692139715; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=2n+nft1J+ou/Hn4BoHtSydnM2Q6o7LrROT4GXzieyqk=; b=Z4tv8uuXCuHU3DyrL7CiwM7GRo//gKoN1gu49jVnkLDa77GxmOTvrZb6iVPtpovqAa y/YZP94ASRtbfUFGv2+k/+4bVka6Zb8iEhQgqrCavmKZqb5Vf3DMxM1GXr8d184OeWox Jkmar07CKdQd0GpGqnTygT2rhd0kL32dr73jAc1qnhLAgdE130ZeCZfffAKAkJ6p4g+3 Dhu8FFeDILrfEK66hbM9G62Cn84pEjVIyl6RtRVPcwxUI4pmvlJGyT/b7ZFu6jTEPe4q d4n4ZEeUzxKpvL+rOyjg+0S0zqmMfzBzAsT4DyiSxbJFnPTWrd8jZrG0UVA3jQ81IpYK PMoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691534915; x=1692139715; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=2n+nft1J+ou/Hn4BoHtSydnM2Q6o7LrROT4GXzieyqk=; b=eiM7Z6MzQu41d4S7pI6q6C53Vy6aWA4GlAx5aiKrIieXEYlemd0r83gBQTE8p+sDXA csE0z8ymXLu7+BG+VbaNfrEn+YaX3FQ52aoDQ0a6SGuh3Eg5q1Fnl6J80euYuH9Y8xgn +g4CsZ8GLXU11a5CMSxf8MEIjLxlLjlsCHFI79pv24yrupqhWUIq+MHrJlrYgYmUmve/ W0q0HmFDr54VIIGNejj1wQLx+Fnd3L32eY0Bg2rSYVQI3fsjFxwT6HdLDMeZK1TONR1E L5mekHWCMJgEmlr/s8wcmVOCKfjqRVYsD/YLWSE1j2ytuQtRWSYXf1SkDvwlZ5MXKVzc cmrg== X-Gm-Message-State: AOJu0Yzm5qwU/DTTeShlKZdw0jqzBkV02XPYEV0Sjvbo7c9AiZUqsm2d 23SlZsau3mE4BWic79RUKC1m/C3yLbl4I6HQpA== X-Received: from jstitt-linux1.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:23b5]) (user=justinstitt job=sendgmr) by 2002:a05:6808:180f:b0:3a6:feb1:bb83 with SMTP id bh15-20020a056808180f00b003a6feb1bb83mr630290oib.3.1691534915476; Tue, 08 Aug 2023 15:48:35 -0700 (PDT) Date: Tue, 08 Aug 2023 22:48:07 +0000 In-Reply-To: <20230808-net-netfilter-v1-0-efbbe4ec60af@google.com> Mime-Version: 1.0 References: <20230808-net-netfilter-v1-0-efbbe4ec60af@google.com> X-Developer-Key: i=justinstitt@google.com; a=ed25519; pk=tC3hNkJQTpNX/gLKxTNQKDmiQl6QjBNCGKJINqAdJsE= X-Developer-Signature: v=1; a=ed25519-sha256; t=1691534912; l=1355; i=justinstitt@google.com; s=20230717; h=from:subject:message-id; bh=h9/FJ0Derc+kHy1+HyfJeM72Jn/xHxsLrarMyJSTkdI=; b=nCzazijk+LV8MhghKkMBl3+PR9A0KP6j7aeC8rKtHaGSgAXmI98rCZPOtIh3eqAsdnnK140X5 2tW2f/G0EY9C+Xes0E05fHk1dEoFtF75/yOMaNAtBErqXMEO7z5CTOV X-Mailer: b4 0.12.3 Message-ID: <20230808-net-netfilter-v1-2-efbbe4ec60af@google.com> Subject: [PATCH 2/7] netfilter: nf_tables: refactor deprecated strncpy From: Justin Stitt To: Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: linux-hardening@vger.kernel.org, Kees Cook , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Justin Stitt X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1773706180628081407 X-GMAIL-MSGID: 1773712243110218230 Prefer `strscpy` over `strncpy`. Signed-off-by: Justin Stitt --- Note: It is hard to tell if there was a bug here in the first place but it's better to use a more robust and less ambiguous interface anyways. `helper->name` has a size of 16 and the 3rd argument to `strncpy` (NF_CT_HELPER_LEN) is also 16. This means that depending on where `dest`'s offset is relative to `regs->data` which has a length of 20, there may be a chance the dest buffer ends up non NUL-terminated. This is probably fine though as the destination buffer in this case may be fine being non NUL-terminated. If this is the case, we should probably opt for `strtomem` instead of `strscpy`. --- net/netfilter/nft_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 38958e067aa8..10126559038b 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -108,7 +108,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr, helper = rcu_dereference(help->helper); if (helper == NULL) goto err; - strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN); + strscpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN); return; #ifdef CONFIG_NF_CONNTRACK_LABELS case NFT_CT_LABELS: {