KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Refactor strncpy_from_user() #336

Open JustinStitt opened 11 months ago

JustinStitt commented 11 months ago

This runs parallel to #90 in that we want to remove this strncpy call in favor of a less ambiguous and more robust api like strscpy or strtomem.

There is a pathological class of strncpy_from_user() functions which you can see here:

https://elixir.bootlin.com/linux/v6.3/source/arch/um/kernel/skas/uaccess.c#L168

Kees had some insights:

It looks like strncpy_from_user() is a confusingly named string copier for crossing kernel/user memory boundary, but it's named badly because it does not NUL-pad the destination, but it does NOT guarantee NUL-termination. Grrrr.