* [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy
@ 2023-05-30 16:41 Azeem Shaikh
2023-05-30 23:21 ` Kees Cook
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Azeem Shaikh @ 2023-05-30 16:41 UTC (permalink / raw)
To: linux-kernel
Cc: linux-hardening, Azeem Shaikh, Alim Akhtar, Avri Altman,
Bart Van Assche, linux-scsi, James E.J. Bottomley,
Martin K. Petersen
strlcpy() reads the entire source buffer first.
This read may exceed the destination size limit.
This is both inefficient and can lead to linear read
overflows if a source string is not NUL-terminated [1].
In an effort to remove strlcpy() completely [2], replace
strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89
Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
---
drivers/ufs/core/ufs-fault-injection.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufs-fault-injection.c b/drivers/ufs/core/ufs-fault-injection.c
index 7ac7c4e7ff83..5b1184aac585 100644
--- a/drivers/ufs/core/ufs-fault-injection.c
+++ b/drivers/ufs/core/ufs-fault-injection.c
@@ -54,7 +54,7 @@ static int ufs_fault_set(const char *val, const struct kernel_param *kp)
if (!setup_fault_attr(attr, (char *)val))
return -EINVAL;
- strlcpy(kp->arg, val, FAULT_INJ_STR_SIZE);
+ strscpy(kp->arg, val, FAULT_INJ_STR_SIZE);
return 0;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy
2023-05-30 16:41 [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy Azeem Shaikh
@ 2023-05-30 23:21 ` Kees Cook
2023-05-31 22:07 ` Martin K. Petersen
2023-06-08 1:42 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Kees Cook @ 2023-05-30 23:21 UTC (permalink / raw)
To: Azeem Shaikh
Cc: linux-kernel, linux-hardening, Alim Akhtar, Avri Altman,
Bart Van Assche, linux-scsi, James E.J. Bottomley,
Martin K. Petersen
On Tue, May 30, 2023 at 04:41:31PM +0000, Azeem Shaikh wrote:
> strlcpy() reads the entire source buffer first.
> This read may exceed the destination size limit.
> This is both inefficient and can lead to linear read
> overflows if a source string is not NUL-terminated [1].
> In an effort to remove strlcpy() completely [2], replace
> strlcpy() here with strscpy().
> No return values were used, so direct replacement is safe.
>
> [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
> [2] https://github.com/KSPP/linux/issues/89
>
> Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy
2023-05-30 16:41 [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy Azeem Shaikh
2023-05-30 23:21 ` Kees Cook
@ 2023-05-31 22:07 ` Martin K. Petersen
2023-06-08 1:42 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2023-05-31 22:07 UTC (permalink / raw)
To: Azeem Shaikh
Cc: linux-kernel, linux-hardening, Alim Akhtar, Avri Altman,
Bart Van Assche, linux-scsi, James E.J. Bottomley,
Martin K. Petersen
Azeem,
> strlcpy() reads the entire source buffer first. This read may exceed
> the destination size limit. This is both inefficient and can lead to
> linear read overflows if a source string is not NUL-terminated [1]. In
> an effort to remove strlcpy() completely [2], replace strlcpy() here
> with strscpy(). No return values were used, so direct replacement is
> safe.
Applied to 6.5/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy
2023-05-30 16:41 [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy Azeem Shaikh
2023-05-30 23:21 ` Kees Cook
2023-05-31 22:07 ` Martin K. Petersen
@ 2023-06-08 1:42 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2023-06-08 1:42 UTC (permalink / raw)
To: linux-kernel, Azeem Shaikh
Cc: Martin K . Petersen, linux-hardening, Alim Akhtar, Avri Altman,
Bart Van Assche, linux-scsi, James E.J. Bottomley
On Tue, 30 May 2023 16:41:31 +0000, Azeem Shaikh wrote:
> strlcpy() reads the entire source buffer first.
> This read may exceed the destination size limit.
> This is both inefficient and can lead to linear read
> overflows if a source string is not NUL-terminated [1].
> In an effort to remove strlcpy() completely [2], replace
> strlcpy() here with strscpy().
> No return values were used, so direct replacement is safe.
>
> [...]
Applied to 6.5/scsi-queue, thanks!
[1/1] scsi: ufs: Replace all non-returning strlcpy with strscpy
https://git.kernel.org/mkp/scsi/c/2516cb882295
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-06-08 1:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-30 16:41 [PATCH] scsi: ufs: Replace all non-returning strlcpy with strscpy Azeem Shaikh
2023-05-30 23:21 ` Kees Cook
2023-05-31 22:07 ` Martin K. Petersen
2023-06-08 1:42 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox