fortify: Fix dropped strcpy() compile-time write overflow check

[ Upstream commit 072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb ]

The implementation for intra-object overflow in str*-family functions
accidentally dropped compile-time write overflow checking in strcpy(),
leaving it entirely to run-time. Add back the intended check.

Fixes: 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions")
Cc: Daniel Axtens <dja@axtens.net>
Cc: Francis Laniel <laniel_francis@privacyrequired.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
index c1be37437e7780fb726a61bff96bd0a9d477b3c8..0c70febd03e95d285ae1bed1a4cfc119581335fe 100644 (file)
--- a/include/linux/fortify-string.h
+++ b/include/linux/fortify-string.h
@@ -280,7 +280,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q)
        if (p_size == (size_t)-1 && q_size == (size_t)-1)
                return __underlying_strcpy(p, q);
        size = strlen(q) + 1;
-       /* test here to use the more stringent object size */
+       /* Compile-time check for const size overflow. */
+       if (__builtin_constant_p(size) && p_size < size)
+               __write_overflow();
+       /* Run-time check for dynamic size overflow. */
        if (p_size < size)
                fortify_panic(__func__);
        memcpy(p, q, size);