Skip to content

Commit b00839c

Browse files
JustinStittcminyard
authored andcommitted
ipmi: refactor deprecated strncpy
`strncpy` is deprecated for use on NUL-terminated destination strings [1]. In this case, strncpy is being used specifically for its NUL-padding behavior (and has been commented as such). Moreover, the destination string is not required to be NUL-terminated [2]. We can use a more robust and less ambiguous interface in `memcpy_and_pad` which makes the code more readable and even eliminates the need for that comment. Let's also use `strnlen` instead of `strlen()` with an upper-bounds check as this is intrinsically a part of `strnlen`. Also included in this patch is a simple 1:1 change of `strncpy` to `strscpy` for ipmi_ssif.c. If NUL-padding is wanted here as well then we should opt again for `strscpy_pad`. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://lore.kernel.org/all/ZQEADYBl0uZ1nX60@mail.minyard.net/ [2] Link: KSPP#90 Cc: linux-hardening@vger.kernel.org Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Justin Stitt <justinstitt@google.com> Message-Id: <20230913-strncpy-drivers-char-ipmi-ipmi-v2-1-e3bc0f6e599f@google.com> Signed-off-by: Corey Minyard <minyard@acm.org>
1 parent 3669558 commit b00839c

File tree

2 files changed

+4
-9
lines changed

2 files changed

+4
-9
lines changed

drivers/char/ipmi/ipmi_msghandler.c

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5377,20 +5377,15 @@ static void send_panic_events(struct ipmi_smi *intf, char *str)
53775377

53785378
j = 0;
53795379
while (*p) {
5380-
int size = strlen(p);
5380+
int size = strnlen(p, 11);
53815381

5382-
if (size > 11)
5383-
size = 11;
53845382
data[0] = 0;
53855383
data[1] = 0;
53865384
data[2] = 0xf0; /* OEM event without timestamp. */
53875385
data[3] = intf->addrinfo[0].address;
53885386
data[4] = j++; /* sequence # */
5389-
/*
5390-
* Always give 11 bytes, so strncpy will fill
5391-
* it with zeroes for me.
5392-
*/
5393-
strncpy(data+5, p, 11);
5387+
5388+
memcpy_and_pad(data+5, 11, p, size, '\0');
53945389
p += size;
53955390

53965391
ipmi_panic_request_and_wait(intf, &addr, &msg);

drivers/char/ipmi/ipmi_ssif.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1945,7 +1945,7 @@ static int new_ssif_client(int addr, char *adapter_name,
19451945
}
19461946
}
19471947

1948-
strncpy(addr_info->binfo.type, DEVICE_NAME,
1948+
strscpy(addr_info->binfo.type, DEVICE_NAME,
19491949
sizeof(addr_info->binfo.type));
19501950
addr_info->binfo.addr = addr;
19511951
addr_info->binfo.platform_data = addr_info;

0 commit comments

Comments
 (0)