From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 32537E7737D for ; Sat, 30 Sep 2023 17:57:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=BJ4ruS5ql0hKHH89JROdm5GvLu/dBjypFzB29v06OZE=; b=KFydGHgt6bp8e+ MVLW73beQsZIRjos+6kJnrgrr3du3CZ91IIdi6CbP68XpR6bZGtR3dRhSzOKHyuBFPXi0rs4ufZFs MFBZO7jw8Hhk9jxnfpXOB5k7vSnn7oHW/nMCvR+kbuSAIwC1d96gw5SqQJx7OIdhw5770ALjXElQ+ uYXeqLrnvWRnCnhwcis50btTsOM4sCHQs7CmLWD8KGepqnM6Cl0kH38kXXLnBOemz84dPG2Y2nByY NMbDKAS4HiP+esXTmYLTEZd9kwDeaHxmZATfeO2kAxpk9+7OimEqddxDsYW31GXF72Qpnvk4XIj6f cC1Txxnzq8dV0xSCv4Yg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qmeDL-009y7c-0a; Sat, 30 Sep 2023 17:57:15 +0000 Received: from mail-pl1-x635.google.com ([2607:f8b0:4864:20::635]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qmeDG-009y6t-30 for linux-arm-kernel@lists.infradead.org; Sat, 30 Sep 2023 17:57:12 +0000 Received: by mail-pl1-x635.google.com with SMTP id d9443c01a7336-1c3cbfa40d6so136932235ad.1 for ; Sat, 30 Sep 2023 10:57:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1696096628; x=1696701428; darn=lists.infradead.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=Ye4XTAWb4daUNWZiDSISaHwk+X7iJoEzGWCL7sgi0rE=; b=LU5uXam1e88Lz3QIlZZI+WJgNHvV0OG9oomv2BxiBeFA2KnQYeg6EqciJbfspVNm0h hhk3T0FscDSL4MMXR+ew0i6ZJAsCz9NvpoUHhtdliBFuWdwA7uhUaV6/FRRTP3tYI74i jHbpQyHUgA84UEkBFZror7+Up+QJUjv7tRLBw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696096628; x=1696701428; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Ye4XTAWb4daUNWZiDSISaHwk+X7iJoEzGWCL7sgi0rE=; b=YUsLKB/Uan4EKPMBitei7AJ97KppIxTnw5u/xymrup0h9JCBdBeK/IJs2CAAZcqQsP 78AA8Z63BPCRFW284SdFj37HUyBgrgD/NNBEAIy8RZ89Qqirl6lZb6fTx0O8oQ5XrjyU VwPOZMMZnvaN/IVgwXRugEOM5cmNuEAW4V766GSNRLgj3lPzqPLgT9awgz523c7SaD41 fKBuBHPnbyojNsTctJwPNyVVY0qXtikdAEInMVSLXQFYectlnol8iTA/dihBM1EHZFGx 8Ox2GaLIuup/27VmhpMh/lOOXqI5YBMw4Yqv/gETz5o+9/kgUqs42HwIIwzN9Fo6q7st aaaQ== X-Gm-Message-State: AOJu0Yz0yVRw+azv4kW/frm40Ulsh4JAdMsJix2bmqUIxrTSJCGJfyfa 4wGxWHFa19UE1kz7vLApusjH/g== X-Google-Smtp-Source: AGHT+IFTEuvq+b7y368t9GEXwnKx90oqxSX/2b3AsPpSe1C2LnJOYtXNrap0hYgQfFUMDxuxcnPy6A== X-Received: by 2002:a17:902:ee89:b0:1c5:f68d:cec3 with SMTP id a9-20020a170902ee8900b001c5f68dcec3mr6686648pld.64.1696096628167; Sat, 30 Sep 2023 10:57:08 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id x10-20020a170902820a00b001c1f161949fsm18920114pln.96.2023.09.30.10.57.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 Sep 2023 10:57:07 -0700 (PDT) Date: Sat, 30 Sep 2023 10:57:03 -0700 From: Kees Cook To: Jonathan Cameron Cc: Justin Stitt , Lars-Peter Clausen , Maxime Coquelin , Alexandre Torgue , linux-iio@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH] iio: adc: stm32-adc: replace deprecated strncpy Message-ID: <202309301056.5A21C37D5@keescook> References: <20230921-strncpy-drivers-iio-adc-stm32-adc-c-v1-1-c50eca098597@google.com> <202309232006.690F89A@keescook> <20230930184118.73d7465a@jic23-huawei> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20230930184118.73d7465a@jic23-huawei> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230930_105711_341229_01771D7B X-CRM114-Status: GOOD ( 31.27 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Sat, Sep 30, 2023 at 06:41:18PM +0100, Jonathan Cameron wrote: > On Sat, 23 Sep 2023 20:15:09 -0700 > Kees Cook wrote: > > > On Thu, Sep 21, 2023 at 04:54:00AM +0000, Justin Stitt wrote: > > > `strncpy` is deprecated for use on NUL-terminated destination strings [1]. > > > > > > We should prefer more robust and less ambiguous string interfaces. > > > > > > We expect adc->chan_name[val] to be NUL-terminated based on ch_name's > > > use within functions that expect NUL-terminated strings like strncmp and > > > printf-likes: > > > | if (!strncmp(stm32_adc_ic[i].name, ch_name, STM32_ADC_CH_SZ)) { > > > | /* Check internal channel availability */ > > > | switch (i) { > > > | case STM32_ADC_INT_CH_VDDCORE: > > > | if (!adc->cfg->regs->or_vddcore.reg) > > > | dev_warn(&indio_dev->dev, > > > | "%s channel not available\n", ch_name); > > > ... > > > > > > There is no evidence that NUL-padding is needed either. > > > > Agreed -- it's used as a C string everywhere I can see. > > > > > > > > Considering the above, a suitable replacement is `strscpy` [2] due to > > > the fact that it guarantees NUL-termination on the destination buffer > > > without unnecessarily NUL-padding. If, for any reason, NUL-padding _is_ > > > required we should go for `strscpy_pad`. > > > > > > Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] > > > Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] > > > Link: https://github.com/KSPP/linux/issues/90 > > > Cc: linux-hardening@vger.kernel.org > > > Signed-off-by: Justin Stitt > > > --- > > > Note: build-tested > > > --- > > > drivers/iio/adc/stm32-adc.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c > > > index f7613efb870d..9cdcf396d901 100644 > > > --- a/drivers/iio/adc/stm32-adc.c > > > +++ b/drivers/iio/adc/stm32-adc.c > > > @@ -2209,7 +2209,7 @@ static int stm32_adc_generic_chan_init(struct iio_dev *indio_dev, > > > ret = -EINVAL; > > > goto err; > > > } > > > - strncpy(adc->chan_name[val], name, STM32_ADC_CH_SZ); > > > + strscpy(adc->chan_name[val], name, STM32_ADC_CH_SZ); > > > > I still prefer sizeof($dst), but yes, these are the same: > > > > char chan_name[STM32_ADC_CH_MAX][STM32_ADC_CH_SZ]; > > > > If this needs a v2, please improve the Subject, but it is technically > > correct, so: > > Hi Kees, > > I can tweak the subject whilst applying. What did you have in mind > as a better one? I would use "iio: adc: stm32-adc: Replace deprecated strncpy() with strscpy()" Thanks! -Kees -- Kees Cook _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel