On Tue, Feb 24, 2026 at 05:04:27PM +0000, Fuad Tabba wrote:
> sized_strscpy() performs word-at-a-time writes to the destination
> buffer. If the destination buffer is not aligned to unsigned long,
> direct assignment causes UBSAN misaligned-access errors.
Is this via CONFIG_UBSAN_ALIGNMENT=y ? Note this in the Kconfig:
Enabling this option on architectures that support unaligned
accesses may produce a lot of false positives.
which architecture are you checking this on?
> Use put_unaligned() to safely write the words to the destination.
Also, I thought the word-at-a-time work in sized_strscpy() was
specifically to take advantage of aligned word writes? This doesn't seem
like the right solution, and I think we're already disabling the
unaligned access by using "max=0" in the earlier checks.
I think the bug may be that you got CONFIG_UBSAN_ALIGNMENT enabled for
an arch that doesn't suffer from unaligned access problems. :) We should
fix the Kconfig!
-Kees
>
> Fixes: 30035e45753b7 ("string: provide strscpy()")
> Signed-off-by: Fuad Tabba <[email protected]>
> ---
> lib/string.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lib/string.c b/lib/string.c
> index b632c71df1a5..a1697bf72078 100644
> --- a/lib/string.c
> +++ b/lib/string.c
> @@ -157,16 +157,16 @@ ssize_t sized_strscpy(char *dest, const char *src,
> size_t count)
> if (has_zero(c, &data, &constants)) {
> data = prep_zero_mask(c, data, &constants);
> data = create_zero_mask(data);
> - *(unsigned long *)(dest+res) = c & zero_bytemask(data);
> + put_unaligned(c & zero_bytemask(data), (unsigned long
> *)(dest+res));
> return res + find_zero(data);
> }
> count -= sizeof(unsigned long);
> if (unlikely(!count)) {
> c &= ALLBUTLAST_BYTE_MASK;
> - *(unsigned long *)(dest+res) = c;
> + put_unaligned(c, (unsigned long *)(dest+res));
> return -E2BIG;
> }
> - *(unsigned long *)(dest+res) = c;
> + put_unaligned(c, (unsigned long *)(dest+res));
> res += sizeof(unsigned long);
> max -= sizeof(unsigned long);
> }
> --
> 2.53.0.371.g1d285c8824-goog
>
>
--
Kees Cook
