linux-kernel - Re: [Outreachy kernel] [PATCH] staging: rtl8192u: ieee80211: Replaced strncpy() with strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YHWZoY6B8sOiflwy@kroah.com>
Date:   Tue, 13 Apr 2021 15:16:17 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     "Fabio M. De Francesco" <fmdefrancesco@...il.com>
Cc:     outreachy-kernel@...glegroups.com, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [Outreachy kernel] [PATCH] staging: rtl8192u: ieee80211:
 Replaced strncpy() with strscpy()

On Tue, Apr 13, 2021 at 03:12:02PM +0200, Fabio M. De Francesco wrote:
> On Tuesday, April 13, 2021 2:59:29 PM CEST Greg Kroah-Hartman wrote:
> > On Tue, Apr 13, 2021 at 02:30:41PM +0200, Fabio M. De Francesco wrote:
> > > Replaced strncpy() with strscpy() because of compilation time warnings
> > > about possible truncation of output [-Wstringop-truncation].
> > 
> > build warnings?  What build warnings?
> >
> drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c:1388:5: warning: 
> ‘strncpy’ output may be truncated copying 32 bytes from a string of length 
> 32 [-Wstringop-truncation]
>  1388 |     strncpy(tmp_ssid, ieee->current_network.ssid, 
> IW_ESSID_MAX_SIZE);

That's implying that there is a real bug here, not that just replacing
it with a different call is going to solve this, right?

And how do you see that, I can't see that in my builds.


> > 
> > > Furthermore, according to the Linux official documentation, strscpy()
> > > is
> > > preferred to strncpy.
> > > 
> > > Signed-off-by: Fabio M. De Francesco <fmdefrancesco@...il.com>
> > > ---
> > > 
> > >  drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
> > > b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c index
> > > 25ea8e1b6b65..aa58eedf5e86 100644
> > > --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
> > > +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
> > > @@ -1385,12 +1385,12 @@ inline void ieee80211_softmac_new_net(struct
> > > ieee80211_device *ieee, struct ieee> 
> > >  			 * essid provided by the user.
> > >  			 */
> > >  			
> > >  			if (!ssidbroad) {
> > > 
> > > -				strncpy(tmp_ssid, ieee-
> >current_network.ssid, IW_ESSID_MAX_SIZE);
> > > +				strscpy(tmp_ssid, ieee-
> >current_network.ssid, IW_ESSID_MAX_SIZE);
> > 
> > Are you sure you can just replace this like this?
> >
> I surely was... but now I'm not anymore, since your review :)
> 
> Maybe you mean I have to check possible return of -E2BIG?
> Did you mean something else?
> May you please elaborate further?

If it was as simple as search/replace, we would have already done that
on the whole codebase at once.  It's not that simple :)

thanks,

greg k-h