linux-kernel - Re: [PATCH] scsi: target: Replace deprecated strncpy() with strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <FB0D4471-9413-4E7D-BFC0-246AD3F54C60@linux.dev>
Date: Sun, 2 Mar 2025 12:41:04 +0100
From: Thorsten Blum <thorsten.blum@...ux.dev>
To: Kees Cook <kees@...nel.org>
Cc: "Martin K. Petersen" <martin.petersen@...cle.com>,
 linux-hardening@...r.kernel.org,
 linux-scsi@...r.kernel.org,
 target-devel@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: target: Replace deprecated strncpy() with strscpy()

On 28. Feb 2025, at 21:10, Kees Cook wrote:
> On Wed, Feb 26, 2025 at 01:10:03PM +0100, Thorsten Blum wrote:
>> Since strncpy() is deprecated for NUL-terminated destination buffers,
>> use strscpy() instead.
>> 
>> Compile-tested only.
>> 
>> Link: https://github.com/KSPP/linux/issues/90
>> Cc: linux-hardening@...r.kernel.org
>> Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
>> ---
> 
> When doing strncpy() to strscpy() conversions, please include details
> of your analysis for several things:
> 
> - why is it safe to be NUL-terminated?
> - why is NUL padding needed/not needed?
> - why is the maximum length argument correct?

Yes, I'll try to describe it better.

> While you're in this file, though, can you replace the other strncpy
> that is used in target_init_dbroot() also?

Ah, I missed this one and will submit a v2 soon.

Thanks,
Thorsten