linux-kernel - Re: [Outreachy kernel] [PATCH] staging: rtl8192u: ieee80211: Replaced strncpy() with strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YHWzENKgthTasHNO@kroah.com>
Date:   Tue, 13 Apr 2021 17:04:48 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     "Fabio M. De Francesco" <fmdefrancesco@...il.com>
Cc:     outreachy-kernel@...glegroups.com, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [Outreachy kernel] [PATCH] staging: rtl8192u: ieee80211:
 Replaced strncpy() with strscpy()

On Tue, Apr 13, 2021 at 03:24:31PM +0200, Fabio M. De Francesco wrote:
> On Tuesday, April 13, 2021 3:16:17 PM CEST Greg Kroah-Hartman wrote:
> > On Tue, Apr 13, 2021 at 03:12:02PM +0200, Fabio M. De Francesco wrote:
> > > On Tuesday, April 13, 2021 2:59:29 PM CEST Greg Kroah-Hartman wrote:
> > > > On Tue, Apr 13, 2021 at 02:30:41PM +0200, Fabio M. De Francesco 
> wrote:
> > > > > Replaced strncpy() with strscpy() because of compilation time
> > > > > warnings
> > > > > about possible truncation of output [-Wstringop-truncation].
> > > > 
> > > > build warnings?  What build warnings?
> > > 
> > > drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c:1388:5: warning:
> > > ‘strncpy’ output may be truncated copying 32 bytes from a string of
> > > length 32 [-Wstringop-truncation]
> > > 
> > >  1388 |     strncpy(tmp_ssid, ieee->current_network.ssid,
> > > 
> > > IW_ESSID_MAX_SIZE);
> > 
> > That's implying that there is a real bug here, not that just replacing
> > it with a different call is going to solve this, right?
> > 
> > And how do you see that, I can't see that in my builds.
> >
> I see that with flag W=1 like in 
> make -j8 drivers/staging/rtl8192u/ W=1

Ah, no one "normal" builds with "W=1" :)

> However I also think it's not a real issue in this context.
> Just that strscpy() is preferred and get rid of warnings.
> You only can judge if a patch is worth.
> I just thought that gcc is (mostly) right in pointing out warnings like 
> that.

Check and verify if this is wrong as-is and if so, then replace it
properly.  Don't just blindly to a search/replace, as that's not ok
here.

thanks,

greg k-h