linux-hardening - Re: [PATCH] scsi: fcoe: replace deprecated strncpy with strscpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 11 Dec 2023 12:37:28 -0800
From: Bart Van Assche <bvanassche@....org>
To: Justin Stitt <justinstitt@...gle.com>
Cc: Hannes Reinecke <hare@...e.de>, "James E.J. Bottomley"
 <jejb@...ux.ibm.com>, "Martin K. Petersen" <martin.petersen@...cle.com>,
 linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-hardening@...r.kernel.org
Subject: Re: [PATCH] scsi: fcoe: replace deprecated strncpy with strscpy

On 12/11/23 12:08, Justin Stitt wrote:
> Hi,
> 
> On Tue, Oct 24, 2023 at 1:01 PM Bart Van Assche <bvanassche@....org> wrote:
>>
>> On 10/24/23 12:52, Justin Stitt wrote:
>>> diff --git a/drivers/scsi/fcoe/fcoe_sysfs.c b/drivers/scsi/fcoe/fcoe_sysfs.c
>>> index e17957f8085c..7a3ca6cd3030 100644
>>> --- a/drivers/scsi/fcoe/fcoe_sysfs.c
>>> +++ b/drivers/scsi/fcoe/fcoe_sysfs.c
>>> @@ -279,12 +279,10 @@ static ssize_t store_ctlr_mode(struct device *dev,
>>>        if (count > FCOE_MAX_MODENAME_LEN)
>>>                return -EINVAL;
>>>
>>> -     strncpy(mode, buf, count);
>>> +     strscpy(mode, buf, count);
>>>
>>>        if (mode[count - 1] == '\n')
>>>                mode[count - 1] = '\0';
>>> -     else
>>> -             mode[count] = '\0';
>>>
>>>        switch (ctlr->enabled) {
>>>        case FCOE_CTLR_ENABLED:
>>
>> Please consider to remove the code for copying the sysfs string and to
>> use sysfs_match_string() instead.
>>
> 
> Sorry, I'm not too familiar with sysfs strings here.
> 
> Let me know what you think of this patch [1].

I don't use FCoE so I will leave it to an FCoE user to review that patch.

Thanks,

Bart.