lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231020-strncpy-drivers-rpmsg-rpmsg_core-c-v1-1-a86b7930c1cf@google.com> Date: Fri, 20 Oct 2023 19:56:59 +0000 From: Justin Stitt <justinstitt@...gle.com> To: Bjorn Andersson <andersson@...nel.org>, Mathieu Poirier <mathieu.poirier@...aro.org> Cc: linux-remoteproc@...r.kernel.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org, Justin Stitt <justinstitt@...gle.com> Subject: [PATCH] rpmsg: core: replace deprecated strncpy with strscpy strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. We expect chinfo.name to be NUL-terminated based on its usage with strncmp(): rpmsg_core.c: 389: if (strncmp(chinfo->name, rpdev->id.name, RPMSG_NAME_SIZE)) Moreover, NUL-padding is not required as chinfo has stack default initialized all fields to zero: rpmsg_core.c: 539: struct rpmsg_channel_info chinfo = {}; Considering the above, a suitable replacement is `strscpy` [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. Also, favor the more idiomatic strscpy() usage of: (dest, src, sizeof(dest)). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@...r.kernel.org Signed-off-by: Justin Stitt <justinstitt@...gle.com> Similar-to: https://lore.kernel.org/all/20231018-strncpy-drivers-net-wwan-rpmsg_wwan_ctrl-c-v1-1-4e343270373a@google.com/ --- Note: build-tested only. Found with: $ rg "strncpy\(" --- drivers/rpmsg/rpmsg_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c index 32b550c91d9f..8abc7d022ff7 100644 --- a/drivers/rpmsg/rpmsg_core.c +++ b/drivers/rpmsg/rpmsg_core.c @@ -545,7 +545,7 @@ static int rpmsg_dev_probe(struct device *dev) goto out; if (rpdrv->callback) { - strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); + strscpy(chinfo.name, rpdev->id.name, sizeof(chinfo.name)); chinfo.src = rpdev->src; chinfo.dst = RPMSG_ADDR_ANY; --- base-commit: bb55d7f7f7445abcc8db50e6a65d4315e79f75c7 change-id: 20231020-strncpy-drivers-rpmsg-rpmsg_core-c-e32ea739a375 Best regards, -- Justin Stitt <justinstitt@...gle.com>
Powered by blists - more mailing lists