maccess: fix strncpy_from_user_nofault() empty string handling
authorMykyta Yatsenko <yatsenko@meta.com>
Tue, 22 Apr 2025 13:14:49 +0000 (14:14 +0100)
committerAndrew Morton <akpm@linux-foundation.org>
Mon, 12 May 2025 00:54:10 +0000 (17:54 -0700)
commit3dc32adf98147b36b25dc579bb438c9ea086b1b4
treed17039a6b2684bf6cc997cf5af8c83e10449079a
parent7123dbbef88cfd9f09e8a7899b0911834600cfa3
maccess: fix strncpy_from_user_nofault() empty string handling

strncpy_from_user_nofault() should return the length of the copied string
including the trailing NUL, but if the argument unsafe_addr points to an
empty string ({'\0'}), the return value is 0.

This happens as strncpy_from_user() copies terminal symbol into dst and
returns 0 (as expected), but strncpy_from_user_nofault does not modify ret
as it is not equal to count and not greater than 0, so 0 is returned,
which contradicts the contract.

Link: https://lkml.kernel.org/r/20250422131449.57177-1-mykyta.yatsenko5@gmail.com
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Reviewed-by: Andrii Nakryiko <andrii@kernel.org>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm/maccess.c