The fortified implementation of strcat() in include/linux/fortify-string.h currently relies on strlcat() to perform bounded concatenation and detect buffer overflows.
In preparation for removing the deprecated strlcat() API[1], replace the strlcat() call in strcat(). When the destination buffer size is unknown (SIZE_MAX), call __underlying_strcat() directly. Otherwise, determine the destination length with __fortify_strlen() and append the source string using __builtin_snprintf(), preserving the existing fortify_panic() check on overflow. Link: https://github.com/KSPP/linux/issues/370 [1] Cc: [email protected] Assisted-by: SecurityEngineer:Gemini1.5Pro [editor_update_file, shell_command_run, test_runner_run_kunit_test] Signed-off-by: Bill Wendling <[email protected]> --- Cc: Russell King <[email protected]> Cc: Huacai Chen <[email protected]> Cc: WANG Xuerui <[email protected]> Cc: Thomas Bogendoerfer <[email protected]> Cc: "James E.J. Bottomley" <[email protected]> Cc: Helge Deller <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Dave Hansen <[email protected]> Cc: [email protected] Cc: "H. Peter Anvin" <[email protected]> Cc: Ian Abbott <[email protected]> Cc: H Hartley Sweeten <[email protected]> Cc: Tony Luck <[email protected]> Cc: Maarten Lankhorst <[email protected]> Cc: Maxime Ripard <[email protected]> Cc: Thomas Zimmermann <[email protected]> Cc: David Airlie <[email protected]> Cc: Simona Vetter <[email protected]> Cc: Matthew Brost <[email protected]> Cc: "Thomas Hellström" <[email protected]> Cc: Rodrigo Vivi <[email protected]> Cc: Dmitry Torokhov <[email protected]> Cc: Matthias Schwarzott <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: Tony Nguyen <[email protected]> Cc: Przemek Kitszel <[email protected]> Cc: Andrew Lunn <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Jakub Kicinski <[email protected]> Cc: Paolo Abeni <[email protected]> Cc: Arend van Spriel <[email protected]> Cc: Rob Herring <[email protected]> Cc: Saravana Kannan <[email protected]> Cc: Krzysztof Kozlowski <[email protected]> Cc: Sylwester Nawrocki <[email protected]> Cc: Peter Griffin <[email protected]> Cc: Alim Akhtar <[email protected]> Cc: Linus Walleij <[email protected]> Cc: Anil Gurumurthy <[email protected]> Cc: Sudarsana Kalluru <[email protected]> Cc: "Martin K. Petersen" <[email protected]> Cc: Trond Myklebust <[email protected]> Cc: Anna Schumaker <[email protected]> Cc: Mike Marshall <[email protected]> Cc: Martin Brandenburg <[email protected]> Cc: Kees Cook <[email protected]> Cc: Jiri Pirko <[email protected]> Cc: Simon Horman <[email protected]> Cc: Chuck Lever <[email protected]> Cc: Jeff Layton <[email protected]> Cc: NeilBrown <[email protected]> Cc: Olga Kornievskaia <[email protected]> Cc: Dai Ngo <[email protected]> Cc: Tom Talpey <[email protected]> Cc: Jaroslav Kysela <[email protected]> Cc: Takashi Iwai <[email protected]> Cc: Bill Wendling <[email protected]> Cc: Andrew Morton <[email protected]> Cc: "Mike Rapoport (Microsoft)" <[email protected]> Cc: Kanglong Wang <[email protected]> Cc: Tiezhu Yang <[email protected]> Cc: Qiang Ma <[email protected]> Cc: Randy Dunlap <[email protected]> Cc: Pengpeng Hou <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Breno Leitao <[email protected]> Cc: Thorsten Blum <[email protected]> Cc: Harshit Mogalapalli <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Lyude Paul <[email protected]> Cc: Ashutosh Desai <[email protected]> Cc: Imre Deak <[email protected]> Cc: Dmitry Baryshkov <[email protected]> Cc: Johan Hovold <[email protected]> Cc: Johannes Berg <[email protected]> Cc: Miri Korenblit <[email protected]> Cc: Alexander Stein <[email protected]> Cc: Cryolitia PukNgae <[email protected]> Cc: Jiaming Zhang <[email protected]> Cc: Will Porter <[email protected]> Cc: Cen Zhang <[email protected]> Cc: "Cássio Gabriel" <[email protected]> Cc: Rong Zhang <[email protected]> Cc: Arun Raghavan <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] --- include/linux/fortify-string.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h index cf841dc71fef..0b489124bfcb 100644 --- a/include/linux/fortify-string.h +++ b/include/linux/fortify-string.h @@ -363,7 +363,12 @@ __FORTIFY_INLINE __diagnose_as(__builtin_strcat, 1, 2) char *strcat(char * const POS p, const char *q) { const size_t p_size = __member_size(p); - const size_t wanted = strlcat(p, q, p_size); + + if (p_size == SIZE_MAX) + return __underlying_strcat(p, q); + + const size_t p_len = __fortify_strlen(p); + const size_t wanted = p_len + __builtin_snprintf(p + p_len, p_size - p_len, "%s", q); if (p_size <= wanted) fortify_panic(FORTIFY_FUNC_strcat, FORTIFY_WRITE, p_size, wanted + 1, p); -- 2.55.0.1032.g73a4cd73de-goog
