Skip to content

Commit 3e24118

Browse files
JustinStittmartinkpetersen
authored andcommitted
scsi: libfc: replace deprecated strncpy() with memcpy()
strncpy() is deprecated [1] and as such we should use different apis to copy string data. We can see that ct is NUL-initialized with fc_ct_hdr_fill: | ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn) + len, ... In fc_ct_hdr_fill(): | memset(ct, 0, ct_plen); We also calculate the length of the source string: | len = strnlen(fc_host_symbolic_name(lport->host), 255); ...then this argument is used in strncpy(), which is bad because the pattern of (dest, src, strlen(src)) usually leaves the destination buffer without NUL-termination. However, it looks as though we do not require NUL-termination since fr_name is part of a seq_buf-like structure wherein its length is monitored: | struct fc_ns_rspn { | struct fc_ns_fid fr_fid; /* port ID object */ | __u8 fr_name_len; | char fr_name[]; | } __attribute__((__packed__)); So, this is really just a byte copy into a length-bounded buffer. Let's use memcpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: KSPP#90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt <justinstitt@google.com> Link: https://lore.kernel.org/r/20240221-strncpy-drivers-scsi-libfc-fc_encode-h-v2-1-019a0889c5ca@google.com Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent e100c01 commit 3e24118

File tree

1 file changed

+8
-6
lines changed

1 file changed

+8
-6
lines changed

drivers/scsi/libfc/fc_encode.h

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -136,22 +136,24 @@ static inline int fc_ct_ns_fill(struct fc_lport *lport,
136136
break;
137137

138138
case FC_NS_RSPN_ID:
139-
len = strnlen(fc_host_symbolic_name(lport->host), 255);
139+
len = strnlen(fc_host_symbolic_name(lport->host),
140+
FC_SYMBOLIC_NAME_SIZE);
140141
ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn) + len,
141142
FC_FST_DIR, FC_NS_SUBTYPE);
142143
hton24(ct->payload.spn.fr_fid.fp_fid, lport->port_id);
143-
strncpy(ct->payload.spn.fr_name,
144-
fc_host_symbolic_name(lport->host), len);
144+
memcpy(ct->payload.spn.fr_name,
145+
fc_host_symbolic_name(lport->host), len);
145146
ct->payload.spn.fr_name_len = len;
146147
break;
147148

148149
case FC_NS_RSNN_NN:
149-
len = strnlen(fc_host_symbolic_name(lport->host), 255);
150+
len = strnlen(fc_host_symbolic_name(lport->host),
151+
FC_SYMBOLIC_NAME_SIZE);
150152
ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rsnn) + len,
151153
FC_FST_DIR, FC_NS_SUBTYPE);
152154
put_unaligned_be64(lport->wwnn, &ct->payload.snn.fr_wwn);
153-
strncpy(ct->payload.snn.fr_name,
154-
fc_host_symbolic_name(lport->host), len);
155+
memcpy(ct->payload.snn.fr_name,
156+
fc_host_symbolic_name(lport->host), len);
155157
ct->payload.snn.fr_name_len = len;
156158
break;
157159

0 commit comments

Comments
 (0)