netdev - Re: [PATCH v1 2/2] net: ethernet: mtk_eth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aa7a15cc-761f-00b0-5582-a8045d8f30ed@reto-schneider.ch>
Date:   Sun, 13 Jun 2021 15:53:50 +0200
From:   Reto Schneider <code@...o-schneider.ch>
To:     "Russell King (Oracle)" <linux@...linux.org.uk>
Cc:     devicetree@...r.kernel.org, linux-mediatek@...ts.infradead.org,
        netdev@...r.kernel.org, Stefan Roese <sr@...x.de>,
        Reto Schneider <reto.schneider@...qvarnagroup.com>,
        "David S. Miller" <davem@...emloft.net>,
        Felix Fietkau <nbd@....name>, Jakub Kicinski <kuba@...nel.org>,
        John Crispin <john@...ozen.org>,
        Mark Lee <Mark-MC.Lee@...iatek.com>,
        Matthias Brugger <matthias.bgg@...il.com>,
        Sean Wang <sean.wang@...iatek.com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 2/2] net: ethernet: mtk_eth_soc: Support custom ifname

Hi Russell,

On 13.06.21 14:20, Russell King (Oracle) wrote:
> Please don't use strncpy() - this is a good example why strncpy() is bad
> news.
> 
>   * strncpy - Copy a length-limited, C-string
>   * @dest: Where to copy the string to
>   * @src: Where to copy the string from
>   * @count: The maximum number of bytes to copy
>   *
>   * The result is not %NUL-terminated if the source exceeds
>   * @count bytes.
> 
> Consequently, if "name" is IFNAMSIZ bytes or longer,
> eth->netdev[id]->name will not be NUL terminated, and subsequent use
> will run off the end of the string. strscpy() is safer to use here.

Thanks a lot for finding this (embarrassing mistake) and pointing me in 
the right direction (did dot know about strscpy).

Will send v2 soon.

Kind regards,
Reto