lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <aa7a15cc-761f-00b0-5582-a8045d8f30ed@reto-schneider.ch>
Date:   Sun, 13 Jun 2021 15:53:50 +0200
From:   Reto Schneider <code@...o-schneider.ch>
To:     "Russell King (Oracle)" <linux@...linux.org.uk>
Cc:     devicetree@...r.kernel.org, linux-mediatek@...ts.infradead.org,
        netdev@...r.kernel.org, Stefan Roese <sr@...x.de>,
        Reto Schneider <reto.schneider@...qvarnagroup.com>,
        "David S. Miller" <davem@...emloft.net>,
        Felix Fietkau <nbd@....name>, Jakub Kicinski <kuba@...nel.org>,
        John Crispin <john@...ozen.org>,
        Mark Lee <Mark-MC.Lee@...iatek.com>,
        Matthias Brugger <matthias.bgg@...il.com>,
        Sean Wang <sean.wang@...iatek.com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 2/2] net: ethernet: mtk_eth_soc: Support custom ifname

Hi Russell,

On 13.06.21 14:20, Russell King (Oracle) wrote:
> Please don't use strncpy() - this is a good example why strncpy() is bad
> news.
> 
>   * strncpy - Copy a length-limited, C-string
>   * @dest: Where to copy the string to
>   * @src: Where to copy the string from
>   * @count: The maximum number of bytes to copy
>   *
>   * The result is not %NUL-terminated if the source exceeds
>   * @count bytes.
> 
> Consequently, if "name" is IFNAMSIZ bytes or longer,
> eth->netdev[id]->name will not be NUL terminated, and subsequent use
> will run off the end of the string. strscpy() is safer to use here.

Thanks a lot for finding this (embarrassing mistake) and pointing me in 
the right direction (did dot know about strscpy).

Will send v2 soon.

Kind regards,
Reto

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ