1 // SPDX-License-Identifier: GPL-2.0
44 	char *src;  in lkdtm_FORTIFY_STR_MEMBER()  local
46 	src = kmalloc(size, GFP_KERNEL);  in lkdtm_FORTIFY_STR_MEMBER()
47 	if (!src)  in lkdtm_FORTIFY_STR_MEMBER()
50 	strscpy(src, "over ten bytes", size);  in lkdtm_FORTIFY_STR_MEMBER()
51 	size = strlen(src) + 1;  in lkdtm_FORTIFY_STR_MEMBER()
56 	 * strncpy(target.a, src, 20); will hit a compile error because the  in lkdtm_FORTIFY_STR_MEMBER()
60 	strncpy(target.a, src, size);  in lkdtm_FORTIFY_STR_MEMBER()
68 	kfree(src);  in lkdtm_FORTIFY_STR_MEMBER()
112 	char *src;  in lkdtm_FORTIFY_MEM_MEMBER()  local
114 	src = kmalloc(size, GFP_KERNEL);  in lkdtm_FORTIFY_MEM_MEMBER()
115 	if (!src)  in lkdtm_FORTIFY_MEM_MEMBER()
118 	strscpy(src, "over ten bytes", size);  in lkdtm_FORTIFY_MEM_MEMBER()
119 	size = strlen(src) + 1;  in lkdtm_FORTIFY_MEM_MEMBER()
124 	 * strncpy(target.a, src, 20); will hit a compile error because the  in lkdtm_FORTIFY_MEM_MEMBER()
128 	memcpy(target.a, src, size);  in lkdtm_FORTIFY_MEM_MEMBER()
136 	kfree(src);  in lkdtm_FORTIFY_MEM_MEMBER()
141  * strscpy and generate a panic because there is a write overflow (i.e. src
146 	char *src;  in lkdtm_FORTIFY_STRSCPY()  local
152 			char src[5];  in lkdtm_FORTIFY_STRSCPY()  member
155 	char weird_dst[sizeof(weird.src) + 1];  in lkdtm_FORTIFY_STRSCPY()
157 	src = kstrdup("foobar", GFP_KERNEL);  in lkdtm_FORTIFY_STRSCPY()
159 	if (src == NULL)  in lkdtm_FORTIFY_STRSCPY()
162 	/* Vanilla strscpy returns -E2BIG if size is 0. */  in lkdtm_FORTIFY_STRSCPY()
163 	if (strscpy(dst, src, 0) != -E2BIG)  in lkdtm_FORTIFY_STRSCPY()
164 		pr_warn("FAIL: strscpy() of 0 length did not return -E2BIG\n");  in lkdtm_FORTIFY_STRSCPY()
166 	/* Vanilla strscpy returns -E2BIG if src is truncated. */  in lkdtm_FORTIFY_STRSCPY()
167 	if (strscpy(dst, src, sizeof(dst)) != -E2BIG)  in lkdtm_FORTIFY_STRSCPY()
168 		pr_warn("FAIL: strscpy() did not return -E2BIG while src is truncated\n");  in lkdtm_FORTIFY_STRSCPY()
170 	/* After above call, dst must contain "foob" because src was truncated. */  in lkdtm_FORTIFY_STRSCPY()
175 	/* Shrink src so the strscpy() below succeeds. */  in lkdtm_FORTIFY_STRSCPY()
176 	src[3] = '\0';  in lkdtm_FORTIFY_STRSCPY()
182 	if (strscpy(dst, src, sizeof(dst)) != 3)  in lkdtm_FORTIFY_STRSCPY()
183 		pr_warn("FAIL: strscpy() did not return 3 while src was copied entirely truncated\n");  in lkdtm_FORTIFY_STRSCPY()
185 	/* After above call, dst must contain "foo" because src was copied. */  in lkdtm_FORTIFY_STRSCPY()
190 	/* Test when src is embedded inside a union. */  in lkdtm_FORTIFY_STRSCPY()
191 	strscpy(weird_dst, weird.src, sizeof(weird_dst));  in lkdtm_FORTIFY_STRSCPY()
197 	/* Restore src to its initial value. */  in lkdtm_FORTIFY_STRSCPY()
198 	src[3] = 'b';  in lkdtm_FORTIFY_STRSCPY()
204 	strscpy(dst, src, strlen(src));  in lkdtm_FORTIFY_STRSCPY()
209 	kfree(src);  in lkdtm_FORTIFY_STRSCPY()