From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EB581C2B for ; Thu, 29 Dec 2022 09:45:15 +0000 (UTC) Received: by mail-wm1-f43.google.com with SMTP id m3so3887551wmq.0 for ; Thu, 29 Dec 2022 01:45:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=JlwudR1yq0j8l6dXe2FNX5uZ434yQGNV8t9LPJL/6tM=; b=nUHwdBrBS6LeYbs+YS3gdxxv7I3AORr8iVEX+sIMxjgK+nNK2hcm/m+/NZyGz55W4m /2WiPf7rALiIl1XNGy8oNlYm3TqHrEVPzEiTZ3vAbqnFGu8msb4hHSMsifMUHYyNlYEv yxE42J1SHiOffhA8G4tZzerRzzqj0unHksAtNmudLgbPN6z6KmoxOpU7iaqiNm2hUQKu cTy2fPBgJQCZfabMZt1p+wQ6DrToheWRi6o8OKVPf9/NHBFNusYwYRdyMSZvkOjCTo+D vAASc9hQuRqsAGS4kON3vXrPQ8HnrkOjkRy+aADHt6hRcORxzbzhyInPK3wrKpze5Z00 Gb7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=JlwudR1yq0j8l6dXe2FNX5uZ434yQGNV8t9LPJL/6tM=; b=ps3wcL2HO1QgUzf20wSSuyVmXbFbnWqL2/qibPKhfRwN7tdFQL02lgUlGX1VpKfAf+ p2TVqCuoFz+zv36kSF2HAXpXGQBHxXgGT+PQQZDiBKmpZ+dAQ+ni/K7H/ePyF9hObGji G5T8h5sUgNcFyFEJX5qi5vCrbE/GVc3auPvaciURtsxMydBFF2XCVRbeZAUqsOSqi/an F3+iWIOK+LM5bgi+QAOwKhWwFl5Hc7xmBWhQSFZW29ClR6UmO6BwcJIL0ECRmdNoLBD2 h8UxeRwQsO2ipL82KjqwORPBdxcR/ZjoRn+mnsMe0jGZ0By2cxjCZMVBUkiORQ7+rwRj SH+A== X-Gm-Message-State: AFqh2ko89JcD+gw6R13Jjw9F46Jhp9gtMyZQ2ovNDnN37VeRn057HO2W sbeQbqDde1WzYOHbsil0maU= X-Google-Smtp-Source: AMrXdXs5lANX27sWsHHeOuHvhjwBNhps7lPfjmKuE+KRWec7tXPH6Us7T2cE1di2Y7ptz7971G9M7w== X-Received: by 2002:a1c:5442:0:b0:3cf:7385:677f with SMTP id p2-20020a1c5442000000b003cf7385677fmr19294169wmi.35.1672307114296; Thu, 29 Dec 2022 01:45:14 -0800 (PST) Received: from localhost ([102.36.222.112]) by smtp.gmail.com with ESMTPSA id i2-20020a05600c354200b003d35acb0fd7sm31043399wmq.34.2022.12.29.01.45.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Dec 2022 01:45:13 -0800 (PST) Date: Thu, 29 Dec 2022 12:45:10 +0300 From: Dan Carpenter To: yang.yang29@zte.com.cn Cc: gustavoars@kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, xu.panda@zte.com.cn Subject: Re: [PATCH linux-next] staging: ks7010: use strscpy() to instead of strncpy() Message-ID: References: <202212261903245548969@zte.com.cn> Precedence: bulk X-Mailing-List: linux-staging@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <202212261903245548969@zte.com.cn> On Mon, Dec 26, 2022 at 07:03:24PM +0800, yang.yang29@zte.com.cn wrote: > From: Xu Panda > > The implementation of strscpy() is more robust and safer. > That's now the recommended way to copy NUL-terminated strings. > > Signed-off-by: Xu Panda > Signed-off-by: Yang Yang > --- > drivers/staging/ks7010/ks_wlan_net.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c > index 044c807ca022..e03c87f0bfe7 100644 > --- a/drivers/staging/ks7010/ks_wlan_net.c > +++ b/drivers/staging/ks7010/ks_wlan_net.c > @@ -382,8 +382,7 @@ static int ks_wlan_get_nick(struct net_device *dev, > return -EPERM; > > /* for SLEEP MODE */ > - strncpy(extra, priv->nick, 16); > - extra[16] = '\0'; > + strscpy(extra, priv->nick, 17); I think this code is a buffer overflow. This is an implementation of SIOCGIWNICKN. net/wireless/wext-core.c 169 [IW_IOCTL_IDX(SIOCGIWNICKN)] = { 170 .header_type = IW_HEADER_TYPE_POINT, 171 .token_size = 1, 172 .max_tokens = IW_ESSID_MAX_SIZE, 173 }, As you can see there is a .max_tokens but no .min_tokens. It is called from ioctl_standard_iw_point(). So if the user specifies something smaller than 17 it leads to a buffer overflow. Your patch is mechanically correct, but now that we have eyes on the code we should fix the security bug instead making checkpatch happy or whatever. regards, dan carpenter