summaryrefslogtreecommitdiff
path: root/drivers/scsi/sd.c
diff options
context:
space:
mode:
authorJustin Stitt <justinstitt@google.com>2024-02-21 23:50:26 +0000
committerMartin K. Petersen <martin.petersen@oracle.com>2024-02-26 21:21:23 -0500
commit3e24118ec1859afe2df18062e1ebdabc12e3b8c1 (patch)
tree5f56717697d3ca9303e2bd7ef7645c09e986159d /drivers/scsi/sd.c
parente100c01efa85c8a0ee7527bf28ef7ea7c3ca57e1 (diff)
scsi: libfc: replace deprecated strncpy() with memcpy()
strncpy() is deprecated [1] and as such we should use different apis to copy string data. We can see that ct is NUL-initialized with fc_ct_hdr_fill: | ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn) + len, ... In fc_ct_hdr_fill(): | memset(ct, 0, ct_plen); We also calculate the length of the source string: | len = strnlen(fc_host_symbolic_name(lport->host), 255); ...then this argument is used in strncpy(), which is bad because the pattern of (dest, src, strlen(src)) usually leaves the destination buffer without NUL-termination. However, it looks as though we do not require NUL-termination since fr_name is part of a seq_buf-like structure wherein its length is monitored: | struct fc_ns_rspn { | struct fc_ns_fid fr_fid; /* port ID object */ | __u8 fr_name_len; | char fr_name[]; | } __attribute__((__packed__)); So, this is really just a byte copy into a length-bounded buffer. Let's use memcpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt <justinstitt@google.com> Link: https://lore.kernel.org/r/20240221-strncpy-drivers-scsi-libfc-fc_encode-h-v2-1-019a0889c5ca@google.com Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/sd.c')
0 files changed, 0 insertions, 0 deletions