linux/fs/hfsplus
Justin Stitt 7dcbf17e3f hfsplus: refactor copy_name to not use strncpy
strncpy() is deprecated with NUL-terminated destination strings [1].

The copy_name() method does a lot of manual buffer manipulation to
eventually arrive with its desired string. If we don't know the
namespace this attr has or belongs to we want to prepend "osx." to our
final string. Following this, we're copying xattr_name and doing a
bizarre manual NUL-byte assignment with a memset where n=1.

Really, we can use some more obvious string APIs to acomplish this,
improving readability and security. Following the same control flow as
before: if we don't know the namespace let's use scnprintf() to form our
prefix + xattr_name pairing (while NUL-terminating too!). Otherwise, use
strscpy() to return the number of bytes copied into our buffer.
Additionally, for non-empty strings, include the NUL-byte in the length
-- matching the behavior of the previous implementation.

Note that strscpy() _can_ return -E2BIG but this is already handled by
all callsites:

In both hfsplus_listxattr_finder_info() and hfsplus_listxattr(), ret is
already type ssize_t so we can change the return type of copy_name() to
match (understanding that scnprintf()'s return type is different yet
fully representable by ssize_t). Furthermore, listxattr() in fs/xattr.c
is well-equipped to handle a potential -E2BIG return result from
vfs_listxattr():
|	ssize_t error;
...
|	error = vfs_listxattr(d, klist, size);
|	if (error > 0) {
|		if (size && copy_to_user(list, klist, error))
|			error = -EFAULT;
|	} else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
|		/* The file system tried to returned a list bigger
|			than XATTR_LIST_MAX bytes. Not possible. */
|		error = -E2BIG;
|	}
... the error can potentially already be -E2BIG, skipping this else-if
and ending up at the same state as other errors.

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html
Link: https://github.com/KSPP/linux/issues/90
Cc:  <linux-hardening@vger.kernel.org>
Signed-off-by: Justin Stitt <justinstitt@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20240401-strncpy-fs-hfsplus-xattr-c-v2-1-6e089999355e@google.com
Signed-off-by: Kees Cook <keescook@chromium.org>
2024-04-24 16:55:28 -07:00
..
attributes.c hfsplus: fix crash and filesystem corruption when deleting files 2020-04-10 15:36:20 -07:00
bfind.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bitmap.c hfsplus: convert kmap() to kmap_local_page() in bitmap.c 2022-09-11 21:55:04 -07:00
bnode.c hfsplus: convert kmap() to kmap_local_page() in bnode.c 2022-09-11 21:55:04 -07:00
brec.c hfsplus: fix BUG on bnode parent update 2018-10-31 08:54:13 -07:00
btree.c hfsplus: convert kmap() to kmap_local_page() in btree.c 2022-09-11 21:55:05 -07:00
catalog.c hfsplus: convert to new timestamp accessors 2023-10-18 14:08:22 +02:00
dir.c hfsplus: convert to ctime accessor functions 2023-07-24 10:30:00 +02:00
extents.c fs: hfsplus: make extend error rate limited 2023-08-18 10:18:55 -07:00
hfsplus_fs.h hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_info 2024-02-25 02:10:31 -05:00
hfsplus_raw.h hfsplus: use struct_group_attr() for memcpy() region 2022-01-20 08:52:54 +02:00
inode.c hfsplus: really remove hfsplus_writepage 2023-12-29 11:58:34 -08:00
ioctl.c hfsplus: convert to fileattr 2021-04-12 15:04:29 +02:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile hfsplus: drop ACL support 2018-08-22 10:52:50 -07:00
options.c hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount 2022-12-11 19:30:20 -08:00
part_tbl.c fs/hfsplus: Use the enum req_op and blk_opf_t types 2022-07-14 12:14:32 -06:00
super.c hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_info 2024-02-25 02:10:31 -05:00
tables.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
unicode.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
wrapper.c fs/hfsplus: use better @opf description 2024-02-12 11:55:13 +01:00
xattr_security.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_trusted.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_user.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr.c hfsplus: refactor copy_name to not use strncpy 2024-04-24 16:55:28 -07:00
xattr.h hfsplus: move hfsplus_xattr_handlers to .rodata 2023-10-09 16:24:19 +02:00