linux-kernel - Re: [PATCH] target/core: replace strncpy with strscpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH4c4jKgPv-Mb1=WvOW+jvGMABXcEgaDMxV0Wit32LPgJitekQ@mail.gmail.com>
Date: Fri, 25 Jul 2025 17:46:24 +0530
From: Pranav Tyagi <pranav.tyagi03@...il.com>
To: "Martin K. Petersen" <martin.petersen@...cle.com>
Cc: linux-scsi@...r.kernel.org, target-devel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, skhan@...uxfoundation.org, 
	linux-kernel-mentees@...ts.linux.dev
Subject: Re: [PATCH] target/core: replace strncpy with strscpy

On Fri, Jul 25, 2025 at 7:22 AM Martin K. Petersen
<martin.petersen@...cle.com> wrote:
>
>
> Pranav,
>
> > strncpy() is deprecated and its use is discouraged. Replace strncpy()
> > with safer strscpy() as the p_buf buffer should be NUL-terminated,
> > since it holds human readable debug output strings.
>
> If you must do this, please change all the similar occurrences of
> strncpy() in that file instead of just one of them.
>
> However, given the fixed size of the buffer and the length of all the
> defined static strings, what is the actual problem you are fixing?
>
> --
> Martin K. Petersen

Hi Martin,

As far as I looked, I could only find the following 4 instances of
strncpy() for the file target_core_transport.c:

target_core_transport.c:1115:           strncpy(p_buf, buf, p_buf_len);
target_core_transport.c:1165:           strncpy(p_buf, buf, p_buf_len);
target_core_transport.c:1225:           strncpy(p_buf, buf, p_buf_len);
target_core_transport.c:1279:           strncpy(p_buf, buf, p_buf_len);

And I have changed all of them in my patch. Kindly point me out to
other instances, if I am missing any.

Also, I intended this to be a cleanup patch for the deprecated
strncpy() function and wanted to replace it with strscpy()
which is encouraged. No functional changes were intended.

Regards
Pranav Tyagi