On 2017/04/19 08:48AM, David Laight wrote:

From: Naveen N. Rao

quoted

Sent: 19 April 2017 09:09
To: David Laight; Michael Ellerman
Cc: linux-kernel@vger.kernel.org; linuxppc-dev@lists.ozlabs.org; Masami Hiramatsu; Ingo Molnar
Subject: RE: [PATCH v2 1/5] kprobes: convert kprobe_lookup_name() to a function

Excerpts from David Laight's message of April 18, 2017 18:22:

quoted

From: Naveen N. Rao

quoted

Sent: 12 April 2017 11:58

...

quoted

+kprobe_opcode_t *kprobe_lookup_name(const char *name)
+{

...

quoted

+	char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN];
+	const char *modsym;
+	bool dot_appended = false;
+	if ((modsym = strchr(name, ':')) != NULL) {
+		modsym++;
+		if (*modsym != '\0' && *modsym != '.') {
+			/* Convert to <module:.symbol> */
+			strncpy(dot_name, name, modsym - name);
+			dot_name[modsym - name] = '.';
+			dot_name[modsym - name + 1] = '\0';
+			strncat(dot_name, modsym,
+				sizeof(dot_name) - (modsym - name) - 2);
+			dot_appended = true;

If the ':' is 'a way down' name[] then although the strncpy() won't
overrun dot_name[] the rest of the code can.

Nice catch, thanks David!
We need to be validating the length of 'name'. I'll put out a patch for
that.

Silent truncation is almost certainly wrong here.

Indeed. This will be handled by the earlier validation to ensure that 
the module name as well as the symbol name are within the expected 
lengths.

quoted

As an aside, I'm not sure I follow what you mean when you say that the
strncpy() won't overrun dot_name[]. If we have a name[] longer than
sizeof(dot_name) with the ':' after that, the strncpy() can also overrun
dot_name[].

Yes, that should just be a memcpy(), as should the strncat().

Using strncpy() where the length is other than the size of the target buffer
should be banned. Not that it ever does what people expect.
strncat() is even worse.

Sure, but with the proper validation, I still think string functions are 
convenient and useful here. I agree about your view on strncat(), so 
I'll switch to strlcat() instead.

Thanks,
Naveen