linux-kernel - Re: [Outreachy kernel] [PATCH] staging: rtl8192u: ieee80211: Replaced strncpy() with strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Apr 2021 15:24:31 +0200
From:   "Fabio M. De Francesco" <fmdefrancesco@...il.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     outreachy-kernel@...glegroups.com, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [Outreachy kernel] [PATCH] staging: rtl8192u: ieee80211: Replaced strncpy() with strscpy()

On Tuesday, April 13, 2021 3:16:17 PM CEST Greg Kroah-Hartman wrote:
> On Tue, Apr 13, 2021 at 03:12:02PM +0200, Fabio M. De Francesco wrote:
> > On Tuesday, April 13, 2021 2:59:29 PM CEST Greg Kroah-Hartman wrote:
> > > On Tue, Apr 13, 2021 at 02:30:41PM +0200, Fabio M. De Francesco 
wrote:
> > > > Replaced strncpy() with strscpy() because of compilation time
> > > > warnings
> > > > about possible truncation of output [-Wstringop-truncation].
> > > 
> > > build warnings?  What build warnings?
> > 
> > drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c:1388:5: warning:
> > ‘strncpy’ output may be truncated copying 32 bytes from a string of
> > length 32 [-Wstringop-truncation]
> > 
> >  1388 |     strncpy(tmp_ssid, ieee->current_network.ssid,
> > 
> > IW_ESSID_MAX_SIZE);
> 
> That's implying that there is a real bug here, not that just replacing
> it with a different call is going to solve this, right?
> 
> And how do you see that, I can't see that in my builds.
>
I see that with flag W=1 like in 
make -j8 drivers/staging/rtl8192u/ W=1

However I also think it's not a real issue in this context.
Just that strscpy() is preferred and get rid of warnings.
You only can judge if a patch is worth.
I just thought that gcc is (mostly) right in pointing out warnings like 
that.

Thanks,

Fabio
> 
> > > > Furthermore, according to the Linux official documentation,
> > > > strscpy()
> > > > is
> > > > preferred to strncpy.
> > > > 
> > > > Signed-off-by: Fabio M. De Francesco <fmdefrancesco@...il.com>
> > > > ---
> > > > 
> > > >  drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > > 
> > > > diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
> > > > b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c index
> > > > 25ea8e1b6b65..aa58eedf5e86 100644
> > > > --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
> > > > +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
> > > > @@ -1385,12 +1385,12 @@ inline void
> > > > ieee80211_softmac_new_net(struct
> > > > ieee80211_device *ieee, struct ieee>
> > > > 
> > > >  			 * essid provided by the user.
> > > >  			 */
> > > >  			
> > > >  			if (!ssidbroad) {
> > > > 
> > > > -				strncpy(tmp_ssid, ieee-
> > >
> > >current_network.ssid, IW_ESSID_MAX_SIZE);
> > >
> > > > +				strscpy(tmp_ssid, ieee-
> > >
> > >current_network.ssid, IW_ESSID_MAX_SIZE);
> > >
> > > Are you sure you can just replace this like this?
> > 
> > I surely was... but now I'm not anymore, since your review :)
> > 
> > Maybe you mean I have to check possible return of -E2BIG?
> > Did you mean something else?
> > May you please elaborate further?
> 
> If it was as simple as search/replace, we would have already done that
> on the whole codebase at once.  It's not that simple :)
> 
> thanks,
> 
> greg k-h