netdev - [PATCH] net: rds transform strncpy to strscpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250407183052.8763-1-goralbaris@gmail.com>
Date: Mon,  7 Apr 2025 21:30:53 +0300
From: Baris Can Goral <goralbaris@...il.com>
To: davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com
Cc: horms@...nel.org,
	netdev@...r.kernel.org,
	allison.henderson@...cle.com,
	skhan@...uxfoundation.org,
	Baris Can Goral <goralbaris@...il.com>
Subject: [PATCH] net: rds transform strncpy to strscpy

Hi,
The strncpy() function is actively dangerous to use since it may not
NULL-terminate the destination string,resulting in potential memory
content exposures, unbounded reads, or crashes.
Link:https://github.com/KSPP/linux/issues/90

Signed-off-by: Baris Can Goral <goralbaris@...il.com>
---
 net/rds/connection.c | 4 ++--
 net/rds/stats.c      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/rds/connection.c b/net/rds/connection.c
index c749c5525b40..fb2f14a1279a 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -749,7 +749,7 @@ static int rds_conn_info_visitor(struct rds_conn_path *cp, void *buffer)
 	cinfo->laddr = conn->c_laddr.s6_addr32[3];
 	cinfo->faddr = conn->c_faddr.s6_addr32[3];
 	cinfo->tos = conn->c_tos;
-	strncpy(cinfo->transport, conn->c_trans->t_name,
+	strscpy(cinfo->transport, conn->c_trans->t_name,
 		sizeof(cinfo->transport));
 	cinfo->flags = 0;
 
@@ -775,7 +775,7 @@ static int rds6_conn_info_visitor(struct rds_conn_path *cp, void *buffer)
 	cinfo6->next_rx_seq = cp->cp_next_rx_seq;
 	cinfo6->laddr = conn->c_laddr;
 	cinfo6->faddr = conn->c_faddr;
-	strncpy(cinfo6->transport, conn->c_trans->t_name,
+	strscpy(cinfo6->transport, conn->c_trans->t_name,
 		sizeof(cinfo6->transport));
 	cinfo6->flags = 0;
 
diff --git a/net/rds/stats.c b/net/rds/stats.c
index 9e87da43c004..63c34dbdf97f 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c
@@ -89,7 +89,7 @@ void rds_stats_info_copy(struct rds_info_iterator *iter,
 
 	for (i = 0; i < nr; i++) {
 		BUG_ON(strlen(names[i]) >= sizeof(ctr.name));
-		strncpy(ctr.name, names[i], sizeof(ctr.name) - 1);
+		strscpy(ctr.name, names[i], sizeof(ctr.name) - 1);
 		ctr.name[sizeof(ctr.name) - 1] = '\0';
 		ctr.value = values[i];
 
-- 
2.34.1