linux-kernel - RE: [PATCH V4 net-next 7/8] net: hns3: Add Ethtool support to HNS3 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <063D6719AE5E284EB5DD2968C1650D6DD003FB65@AcuExch.aculab.com>
Date:   Tue, 25 Jul 2017 09:35:51 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     "'Rustad, Mark D'" <mark.d.rustad@...el.com>,
        Florian Fainelli <f.fainelli@...il.com>
CC:     Salil Mehta <salil.mehta@...wei.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "yisen.zhuang@...wei.com" <yisen.zhuang@...wei.com>,
        "huangdaode@...ilicon.com" <huangdaode@...ilicon.com>,
        "lipeng321@...wei.com" <lipeng321@...wei.com>,
        "mehta.salil.lnk@...il.com" <mehta.salil.lnk@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
        "linuxarm@...wei.com" <linuxarm@...wei.com>
Subject: RE: [PATCH V4 net-next 7/8] net: hns3: Add Ethtool support to HNS3
 driver

From: Rustad, Mark D
> Sent: 24 July 2017 21:32
> > On Jul 23, 2017, at 10:05 AM, Florian Fainelli <f.fainelli@...il.com> wrote:
> >> +
> >> +	strncpy(drvinfo->version, HNAE_DRIVER_VERSION,
> >> +		sizeof(drvinfo->version));
> >> +	drvinfo->version[sizeof(drvinfo->version) - 1] = '\0';
> >
> > strlcpy() would probably do that for you.
> 
> You need to be careful about strlcpy - it does not completely write the destination buffer as strncpy
> does, and so can result in a kernel memory leak if the destination is not known to already be cleared.

Not only that, strlcpy() is defined to return the size of the
source string.
So if the source buffers isn't '\0' terminated it can fault.
(Not a problem above.)

Neither function is the one you were looking for.

	David