linux-kernel - Re: [RESEND PATCH-next] staging: rtl8723bs: replace deprecated strncpy with strscpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f0abc689-a084-4c74-b5fe-3592eceb3399@suswa.mountain>
Date:   Wed, 13 Dec 2023 16:13:22 +0300
From:   Dan Carpenter <dan.carpenter@...aro.org>
To:     xueqin Luo <luoxueqin@...inos.cn>
Cc:     gregkh@...uxfoundation.org, hdegoede@...hat.com,
        Larry.Finger@...inger.net, xiongxin@...inos.cn, wangqi@...inos.cn,
        linux-kernel@...r.kernel.org, linux-staging@...ts.linux.dev
Subject: Re: [RESEND PATCH-next] staging: rtl8723bs: replace deprecated
 strncpy with strscpy_pad

On Wed, Dec 13, 2023 at 09:18:40AM +0800, xueqin Luo wrote:
> `strncpy` is deprecated for use on NUL-terminated destination strings
> [1] and as such we should prefer more robust and less ambiguous string
> interfaces.
> 
> We should NUL-pad as there are full struct copies happening in places:
> |	case NL80211_IFTYPE_MONITOR:
> |                ret = rtw_cfg80211_add_monitor_if(padapter,
> |						(char *)name, &ndev);
> |                break;
> 

I don't see where the full copy is...  What you're looking for is some
place that copies "mon_ndev->name" to the user.

> A suitable replacement is `strscpy_pad` due to the fact that it
> guarantees both NUL-termination and NUL-padding on the destination
> buffer.
> 
> Additionally, replace size macro `IFNAMSIZ` with sizeof():
> |	struct net_device {
> |		char			name[IFNAMSIZ];
> |		...

This would normally be the right move but IFNAMSIZ is a really standard
macro that everyone knows.

When I'm reviewing this code, I later on see a line:

	memcpy(pwdev_priv->ifname_mon, name, IFNAMSIZ + 1);

That means name must be "IFNAMSIZ + 1" characters long or it is a bug.
Please find out where name is set.  We need to know how long it is
before we can go any further.

regards,
dan carpenter