Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

string: Add load_unaligned_zeropad() code path to sized_strscpy()

The call to read_word_at_a_time() in sized_strscpy() is problematic
with MTE because it may trigger a tag check fault when reading
across a tag granule (16 bytes) boundary. To make this code
MTE compatible, let's start using load_unaligned_zeropad()
on architectures where it is available (i.e. architectures that
define CONFIG_DCACHE_WORD_ACCESS). Because load_unaligned_zeropad()
takes care of page boundaries as well as tag granule boundaries,
also disable the code preventing crossing page boundaries when using
load_unaligned_zeropad().

Signed-off-by: Peter Collingbourne <pcc@google.com>
Link: https://linux-review.googlesource.com/id/If4b22e43b5a4ca49726b4bf98ada827fdf755548
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: stable@vger.kernel.org
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20250403000703.2584581-2-pcc@google.com
Signed-off-by: Kees Cook <kees@kernel.org>

authored by

Peter Collingbourne and committed by
Kees Cook
d94c12bd 8ffd015d

+10 -3
+10 -3
lib/string.c
··· 119 119 if (count == 0 || WARN_ON_ONCE(count > INT_MAX)) 120 120 return -E2BIG; 121 121 122 + #ifndef CONFIG_DCACHE_WORD_ACCESS 122 123 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 123 124 /* 124 125 * If src is unaligned, don't cross a page boundary, ··· 135 134 if (((long) dest | (long) src) & (sizeof(long) - 1)) 136 135 max = 0; 137 136 #endif 137 + #endif 138 138 139 139 /* 140 - * read_word_at_a_time() below may read uninitialized bytes after the 141 - * trailing zero and use them in comparisons. Disable this optimization 142 - * under KMSAN to prevent false positive reports. 140 + * load_unaligned_zeropad() or read_word_at_a_time() below may read 141 + * uninitialized bytes after the trailing zero and use them in 142 + * comparisons. Disable this optimization under KMSAN to prevent 143 + * false positive reports. 143 144 */ 144 145 if (IS_ENABLED(CONFIG_KMSAN)) 145 146 max = 0; ··· 149 146 while (max >= sizeof(unsigned long)) { 150 147 unsigned long c, data; 151 148 149 + #ifdef CONFIG_DCACHE_WORD_ACCESS 150 + c = load_unaligned_zeropad(src+res); 151 + #else 152 152 c = read_word_at_a_time(src+res); 153 + #endif 153 154 if (has_zero(c, &data, &constants)) { 154 155 data = prep_zero_mask(c, data, &constants); 155 156 data = create_zero_mask(data);