mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
Shao Mingyin
282f4a8aa9
The aligned scan boundary is derived from the last valid byte, (s + count - 1). When count is huge (e.g. SIZE_MAX, which FORTIFY strcat/strlcat pass when the destination size is not known at compile time), s + count wraps around and the boundary lands before s, so the ZBB path returns a bogus length. The original implementation (5ba15d419f) had the same wrap-around in its (s + count) & ~7 boundary computation; after5d588c6848the wrapped boundary is caught by the pre-loop guard "bgeu t0, t4, 2f", which then always exits for aligned strings of 8 or more characters and strnlen() returns 8 instead of the real length. This silently truncates strings built by fortified strcat: the dm sysfs name attribute shows "live-bas" instead of "live-base", the truncated name pollutes the udev database, and blivet/anaconda (as well as LVM/dm-crypt/multipath userspace) break on RISC-V systems. Detect the wrap-around and saturate the boundary to the top of the address space, making the scan equivalent to strlen(). The saturation clamps the increment to ~s, so it stays branchless and wrap-free: s + min(count - 1, ~s) == saturating_add(s, count - 1) Normal counts are unaffected. Fixes:5ba15d419f("riscv: lib: add strnlen() implementation") Cc: stable@vger.kernel.org Suggested-by: David Laight <david.laight.linux@gmail.com> Suggested-by: Qingfang Deng <qingfang.deng@linux.dev> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn> Acked-by: Michael Neuling <mikey@neuling.org> Tested-by: Troy Mitchell <troy.mitchell@linux.dev> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Link: https://patch.msgid.link/20260915152656708z04s4oSYY2BGj34F36RZa@zte.com.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>