linux-kernel - Re: [PATCH v2] scsi: hpsa: Replace deprecated strncpy() with strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250213223032.20d64851@pumpkin>
Date: Thu, 13 Feb 2025 22:30:32 +0000
From: David Laight <david.laight.linux@...il.com>
To: Bart Van Assche <bvanassche@....org>
Cc: Thorsten Blum <thorsten.blum@...ux.dev>, Don Brace
 <don.brace@...rochip.com>, "James E.J. Bottomley"
 <James.Bottomley@...senPartnership.com>, "Martin K. Petersen"
 <martin.petersen@...cle.com>, linux-hardening@...r.kernel.org,
 storagedev@...rochip.com, linux-scsi@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] scsi: hpsa: Replace deprecated strncpy() with
 strscpy()

On Thu, 13 Feb 2025 12:34:55 -0800
Bart Van Assche <bvanassche@....org> wrote:

> On 2/13/25 11:53 AM, Thorsten Blum wrote:
> > diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
> > index 84d8de07b7ae..c7ebae24b09f 100644
> > --- a/drivers/scsi/hpsa.c
> > +++ b/drivers/scsi/hpsa.c
> > @@ -460,9 +460,8 @@ static ssize_t host_store_hp_ssd_smart_path_status(struct device *dev,
> >   
> >   	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
> >   		return -EACCES;
> > -	len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count;
> > -	strncpy(tmpbuf, buf, len);
> > -	tmpbuf[len] = '\0';
> > +	len = min(count + 1, sizeof(tmpbuf));
> > +	strscpy(tmpbuf, buf, len);
> >   	if (sscanf(tmpbuf, "%d", &status) != 1)
> >   		return -EINVAL;
> >   	h = shost_to_hba(shost);
> > @@ -484,9 +483,8 @@ static ssize_t host_store_raid_offload_debug(struct device *dev,
> >   
> >   	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
> >   		return -EACCES;
> > -	len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count;
> > -	strncpy(tmpbuf, buf, len);
> > -	tmpbuf[len] = '\0';
> > +	len = min(count + 1, sizeof(tmpbuf));
> > +	strscpy(tmpbuf, buf, len);
> >   	if (sscanf(tmpbuf, "%d", &debug_level) != 1)
> >   		return -EINVAL;
> >   	if (debug_level < 0)  
> 
> Something I should have noticed earlier: this code occurs inside sysfs
> write callbacks. The strings passed to sysfs write callbacks are
> 0-terminated. Hence, 'buf' can be passed directly to sscanf() and
> tmpbuf[] can be removed. From kernfs_fop_write_iter() in fs/kernfs.c:
> 
> 	buf[len] = '\0';	/* guarantee string termination */

You might also want to use one of the stroul() family rather than sscanf().

	David.

> 
> Thanks,
> 
> Bart.
>