linux-hardening - Re: [PATCH] thermal: intel: int340x_thermal: replace deprecated strncpy with strscpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 27 Mar 2024 14:59:02 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: srinivas pandruvada <srinivas.pandruvada@...ux.intel.com>, 
	Justin Stitt <justinstitt@...gle.com>
Cc: Daniel Lezcano <daniel.lezcano@...aro.org>, Zhang Rui <rui.zhang@...el.com>, 
	Lukasz Luba <lukasz.luba@....com>, linux-pm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH] thermal: intel: int340x_thermal: replace deprecated
 strncpy with strscpy

On Tue, Mar 19, 2024 at 5:20 PM srinivas pandruvada
<srinivas.pandruvada@...ux.intel.com> wrote:
>
> On Tue, 2024-03-19 at 12:39 +0100, Rafael J. Wysocki wrote:
> > On Mon, Mar 18, 2024 at 11:36 PM Justin Stitt
> > <justinstitt@...gle.com> wrote:
> > >
> > > strncpy() is deprecated for use on NUL-terminated destination
> > > strings
> > > [1] and as such we should prefer more robust and less ambiguous
> > > string
> > > interfaces.
> > >
> > > psvt->limit.string can only be 8 bytes so let's use the appropriate
> > > size
> > > macro ACPI_LIMIT_STR_MAX_LEN.
> > >
> > > Neither psvt->limit.string or psvt_user[i].limit.string requires
> > > the
> > > NUL-padding behavior that strncpy() provides as they have both been
> > > filled with NUL-bytes prior to the string operation.
> > > >       memset(&psvt->limit, 0, sizeof(u64));
> > > and
> > > >       psvt_user = kzalloc(psvt_len, GFP_KERNEL);
> > >
> > > Let's use `strscpy` [2] due to the fact that it guarantees
> > > NUL-termination on the destination buffer without unnecessarily
> > > NUL-padding.
> > >
> > > Link:
> > > https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings
> > >  [1]
> > > Link:
> > > https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html
> > >  [2]
> > > Link: https://github.com/KSPP/linux/issues/90
> > > Cc: linux-hardening@...r.kernel.org
> > > Signed-off-by: Justin Stitt <justinstitt@...gle.com>
> >
> > Srinivas, any objections?
> No
>
> Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>

Applied as 6.10 material, thanks!