From: Greg KH <gregkh@linuxfoundation.org>
To: Pranav Tyagi <pranav.tyagi03@gmail.com>
Cc: johan@kernel.org, elder@kernel.org, vireshk@kernel.org,
greybus-dev@lists.linaro.org, linux-staging@lists.linux.dev,
linux-kernel@vger.kernel.org, skhan@linuxfoundation.org,
linux-kernel-mentees@lists.linux.dev
Subject: Re: [PATCH] greybus: firmware: use strscpy, fix tag size
Date: Tue, 17 Jun 2025 15:16:06 +0200 [thread overview]
Message-ID: <2025061743-surging-legwarmer-b3a9@gregkh> (raw)
In-Reply-To: <20250617125137.24503-1-pranav.tyagi03@gmail.com>
On Tue, Jun 17, 2025 at 06:21:37PM +0530, Pranav Tyagi wrote:
> Increase the size of firmware_tag arrays in the following structs from
> GB_FIRMWARE_U_TAG_MAX_SIZE to GB_FIRMWARE_U_TAG_MAX_SIZE + 1 to
> accommodate null termination:
> - fw_mgmt_ioc_intf_load_and_validate
> - fw_mgmt_ioc_get_backend_version
> - fw_mgmt_ioc_backend_fw_update
> - fw_mgmt_ioc_get_intf_version
>
> Replace strncpy() with strscpy() to ensure proper null termination as
> firmware_tag is interpreted as a null-terminated string
> and printed with %s.
>
> Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
> ---
> .../greybus/Documentation/firmware/firmware.c | 12 ++++++------
> drivers/staging/greybus/greybus_firmware.h | 8 ++++----
> 2 files changed, 10 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/staging/greybus/Documentation/firmware/firmware.c b/drivers/staging/greybus/Documentation/firmware/firmware.c
> index 765d69faa9cc..3b4061f4b34a 100644
> --- a/drivers/staging/greybus/Documentation/firmware/firmware.c
> +++ b/drivers/staging/greybus/Documentation/firmware/firmware.c
> @@ -63,8 +63,8 @@ static int update_intf_firmware(int fd)
> intf_load.major = 0;
> intf_load.minor = 0;
>
> - strncpy((char *)&intf_load.firmware_tag, firmware_tag,
> - GB_FIRMWARE_U_TAG_MAX_SIZE);
> + strscpy((char *)&intf_load.firmware_tag, firmware_tag,
> + GB_FIRMWARE_U_TAG_MAX_SIZE + 1);
>
> ret = ioctl(fd, FW_MGMT_IOC_INTF_LOAD_AND_VALIDATE, &intf_load);
> if (ret < 0) {
> @@ -101,8 +101,8 @@ static int update_backend_firmware(int fd)
> /* Get Backend Firmware Version */
> printf("Getting Backend Firmware Version\n");
>
> - strncpy((char *)&backend_fw_info.firmware_tag, firmware_tag,
> - GB_FIRMWARE_U_TAG_MAX_SIZE);
> + strscpy((char *)&backend_fw_info.firmware_tag, firmware_tag,
> + GB_FIRMWARE_U_TAG_MAX_SIZE + 1);
>
> retry_fw_version:
> ret = ioctl(fd, FW_MGMT_IOC_GET_BACKEND_FW, &backend_fw_info);
> @@ -129,8 +129,8 @@ static int update_backend_firmware(int fd)
> /* Try Backend Firmware Update over Unipro */
> printf("Updating Backend Firmware\n");
>
> - strncpy((char *)&backend_update.firmware_tag, firmware_tag,
> - GB_FIRMWARE_U_TAG_MAX_SIZE);
> + strscpy((char *)&backend_update.firmware_tag, firmware_tag,
> + GB_FIRMWARE_U_TAG_MAX_SIZE + 1);
>
> retry_fw_update:
> backend_update.status = 0;
> diff --git a/drivers/staging/greybus/greybus_firmware.h b/drivers/staging/greybus/greybus_firmware.h
> index b6042a82ada4..ad5b2c8a6461 100644
> --- a/drivers/staging/greybus/greybus_firmware.h
> +++ b/drivers/staging/greybus/greybus_firmware.h
> @@ -38,20 +38,20 @@
>
> /* IOCTL support */
> struct fw_mgmt_ioc_get_intf_version {
> - __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE];
> + __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE + 1];
> __u16 major;
> __u16 minor;
> } __packed;
>
> struct fw_mgmt_ioc_get_backend_version {
> - __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE];
> + __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE + 1];
> __u16 major;
> __u16 minor;
> __u8 status;
> } __packed;
>
> struct fw_mgmt_ioc_intf_load_and_validate {
> - __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE];
> + __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE + 1];
> __u8 load_method;
> __u8 status;
> __u16 major;
> @@ -59,7 +59,7 @@ struct fw_mgmt_ioc_intf_load_and_validate {
> } __packed;
>
> struct fw_mgmt_ioc_backend_fw_update {
> - __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE];
> + __u8 firmware_tag[GB_FIRMWARE_U_TAG_MAX_SIZE + 1];
> __u8 status;
> } __packed;
>
You are changing the size of a userspace structure here, are you SURE
this is allowed?
How was this tested?
thanks,
greg k-h
next prev parent reply other threads:[~2025-06-17 13:16 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-17 12:51 [PATCH] greybus: firmware: use strscpy, fix tag size Pranav Tyagi
2025-06-17 13:16 ` Greg KH [this message]
2025-06-18 6:27 ` Pranav Tyagi
2025-06-18 20:42 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2025061743-surging-legwarmer-b3a9@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=elder@kernel.org \
--cc=greybus-dev@lists.linaro.org \
--cc=johan@kernel.org \
--cc=linux-kernel-mentees@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=pranav.tyagi03@gmail.com \
--cc=skhan@linuxfoundation.org \
--cc=vireshk@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox