* [PATCH] usb: typec: tcpm: replace strcpy with strscpy
@ 2026-04-19 21:36 Maxwell Doose
2026-04-23 19:23 ` Amit Sunil Dhamne
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Maxwell Doose @ 2026-04-19 21:36 UTC (permalink / raw)
To: badhri, heikki.krogerus, gregkh; +Cc: linux-usb, linux-kernel
The function strcpy() is deprecated as it can be used in buffer overflow
attacks. This patch replaces strcpy() with strscpy() to improve
security and stability.
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
---
drivers/usb/typec/tcpm/tcpm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 8e0e14a2704e..69574c5e79e1 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
if (tcpm_log_full(port)) {
port->logbuffer_head = max(port->logbuffer_head - 1, 0);
- strcpy(tmpbuffer, "overflow");
+ strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
}
if (port->logbuffer_head < 0 ||
@@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
pdo_spr_avs_apdo_src_peak_current(pdo));
else
- strcpy(msg, "undefined APDO");
+ strscpy(msg, "undefined APDO", sizeof(msg));
break;
default:
- strcpy(msg, "undefined");
+ strscpy(msg, "undefined", sizeof(msg));
break;
}
tcpm_log(port, " PDO %d: type %d, %s",
--
2.53.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
2026-04-19 21:36 [PATCH] usb: typec: tcpm: replace strcpy with strscpy Maxwell Doose
@ 2026-04-23 19:23 ` Amit Sunil Dhamne
2026-04-23 20:56 ` Maxwell Doose
2026-04-29 8:54 ` David Laight
2026-04-27 23:01 ` kernel test robot
2026-04-28 23:11 ` kernel test robot
2 siblings, 2 replies; 6+ messages in thread
From: Amit Sunil Dhamne @ 2026-04-23 19:23 UTC (permalink / raw)
To: Maxwell Doose, badhri, heikki.krogerus, gregkh; +Cc: linux-usb, linux-kernel
Hi Maxwell,
On 4/19/26 2:36 PM, Maxwell Doose wrote:
> The function strcpy() is deprecated as it can be used in buffer overflow
> attacks. This patch replaces strcpy() with strscpy() to improve
> security and stability.
>
> Signed-off-by: Maxwell Doose <m32285159@gmail.com>
> ---
> drivers/usb/typec/tcpm/tcpm.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> index 8e0e14a2704e..69574c5e79e1 100644
> --- a/drivers/usb/typec/tcpm/tcpm.c
> +++ b/drivers/usb/typec/tcpm/tcpm.c
> @@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
>
> if (tcpm_log_full(port)) {
> port->logbuffer_head = max(port->logbuffer_head - 1, 0);
> - strcpy(tmpbuffer, "overflow");
> + strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
> }
>
> if (port->logbuffer_head < 0 ||
> @@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
> pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
> pdo_spr_avs_apdo_src_peak_current(pdo));
> else
> - strcpy(msg, "undefined APDO");
> + strscpy(msg, "undefined APDO", sizeof(msg));
> break;
> default:
> - strcpy(msg, "undefined");
> + strscpy(msg, "undefined", sizeof(msg));
> break;
> }
> tcpm_log(port, " PDO %d: type %d, %s",
This has already been fixed as part of [1].
[1] https://patch.msgid.link/20260310094434.3639602-5-aichao@kylinos.cn
BR,
Amit
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
2026-04-23 19:23 ` Amit Sunil Dhamne
@ 2026-04-23 20:56 ` Maxwell Doose
2026-04-29 8:54 ` David Laight
1 sibling, 0 replies; 6+ messages in thread
From: Maxwell Doose @ 2026-04-23 20:56 UTC (permalink / raw)
To: Amit Sunil Dhamne
Cc: badhri, heikki.krogerus, gregkh, linux-usb, linux-kernel
On Thu, Apr 23, 2026 at 2:23 PM Amit Sunil Dhamne <amitsd@google.com> wrote:
>
> Hi Maxwell,
>
> This has already been fixed as part of [1].
>
> [1] https://patch.msgid.link/20260310094434.3639602-5-aichao@kylinos.cn
>
Ah, didn't see that. I'll go focus on other things for now then.
best regards,
maxwell
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
2026-04-19 21:36 [PATCH] usb: typec: tcpm: replace strcpy with strscpy Maxwell Doose
2026-04-23 19:23 ` Amit Sunil Dhamne
@ 2026-04-27 23:01 ` kernel test robot
2026-04-28 23:11 ` kernel test robot
2 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2026-04-27 23:01 UTC (permalink / raw)
To: Maxwell Doose, badhri, heikki.krogerus, gregkh
Cc: oe-kbuild-all, linux-usb, linux-kernel
Hi Maxwell,
kernel test robot noticed the following build errors:
[auto build test ERROR on v7.0]
[cannot apply to usb/usb-testing usb/usb-next usb/usb-linus linus/master next-20260427]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Maxwell-Doose/usb-typec-tcpm-replace-strcpy-with-strscpy/20260427-011111
base: v7.0
patch link: https://lore.kernel.org/r/20260419213638.38291-2-m32285159%40gmail.com
patch subject: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
config: m68k-allmodconfig (https://download.01.org/0day-ci/archive/20260428/202604280624.g6vOa3Cf-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260428/202604280624.g6vOa3Cf-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604280624.g6vOa3Cf-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/usb/typec/tcpm/tcpm.c: In function '_tcpm_log':
>> drivers/usb/typec/tcpm/tcpm.c:729:9: error: expected ';' before '}' token
729 | }
| ^
vim +729 drivers/usb/typec/tcpm/tcpm.c
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 706
e79e01254d02ff drivers/staging/typec/tcpm.c Joe Perches 2017-08-25 707 __printf(2, 0)
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 708 static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 709 {
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 710 char tmpbuffer[LOG_BUFFER_ENTRY_SIZE];
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 711 u64 ts_nsec = local_clock();
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 712 unsigned long rem_nsec;
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 713
d5a4f93511b700 drivers/usb/typec/tcpm.c Peter Chen 2018-06-12 714 mutex_lock(&port->logbuffer_lock);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 715 if (!port->logbuffer[port->logbuffer_head]) {
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 716 port->logbuffer[port->logbuffer_head] =
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 717 kzalloc(LOG_BUFFER_ENTRY_SIZE, GFP_KERNEL);
d5a4f93511b700 drivers/usb/typec/tcpm.c Peter Chen 2018-06-12 718 if (!port->logbuffer[port->logbuffer_head]) {
d5a4f93511b700 drivers/usb/typec/tcpm.c Peter Chen 2018-06-12 719 mutex_unlock(&port->logbuffer_lock);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 720 return;
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 721 }
d5a4f93511b700 drivers/usb/typec/tcpm.c Peter Chen 2018-06-12 722 }
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 723
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 724 vsnprintf(tmpbuffer, sizeof(tmpbuffer), fmt, args);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 725
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 726 if (tcpm_log_full(port)) {
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 727 port->logbuffer_head = max(port->logbuffer_head - 1, 0);
2919950c498311 drivers/usb/typec/tcpm/tcpm.c Maxwell Doose 2026-04-19 728 strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 @729 }
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 730
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 731 if (port->logbuffer_head < 0 ||
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 732 port->logbuffer_head >= LOG_BUFFER_ENTRIES) {
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 733 dev_warn(port->dev,
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 734 "Bad log buffer index %d\n", port->logbuffer_head);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 735 goto abort;
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 736 }
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 737
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 738 if (!port->logbuffer[port->logbuffer_head]) {
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 739 dev_warn(port->dev,
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 740 "Log buffer index %d is NULL\n", port->logbuffer_head);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 741 goto abort;
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 742 }
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 743
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 744 rem_nsec = do_div(ts_nsec, 1000000000);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 745 scnprintf(port->logbuffer[port->logbuffer_head],
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 746 LOG_BUFFER_ENTRY_SIZE, "[%5lu.%06lu] %s",
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 747 (unsigned long)ts_nsec, rem_nsec / 1000,
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 748 tmpbuffer);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 749 port->logbuffer_head = (port->logbuffer_head + 1) % LOG_BUFFER_ENTRIES;
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 750
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 751 abort:
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 752 mutex_unlock(&port->logbuffer_lock);
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 753 }
f0690a25a140b8 drivers/staging/typec/tcpm.c Guenter Roeck 2017-04-27 754
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
2026-04-19 21:36 [PATCH] usb: typec: tcpm: replace strcpy with strscpy Maxwell Doose
2026-04-23 19:23 ` Amit Sunil Dhamne
2026-04-27 23:01 ` kernel test robot
@ 2026-04-28 23:11 ` kernel test robot
2 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2026-04-28 23:11 UTC (permalink / raw)
To: Maxwell Doose, badhri, heikki.krogerus, gregkh
Cc: llvm, oe-kbuild-all, linux-usb, linux-kernel
Hi Maxwell,
kernel test robot noticed the following build errors:
[auto build test ERROR on v7.0]
[cannot apply to usb/usb-testing usb/usb-next usb/usb-linus linus/master next-20260428]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Maxwell-Doose/usb-typec-tcpm-replace-strcpy-with-strscpy/20260427-011111
base: v7.0
patch link: https://lore.kernel.org/r/20260419213638.38291-2-m32285159%40gmail.com
patch subject: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
config: riscv-allyesconfig (https://download.01.org/0day-ci/archive/20260429/202604290711.kHqUSJ8v-lkp@intel.com/config)
compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260429/202604290711.kHqUSJ8v-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604290711.kHqUSJ8v-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/usb/typec/tcpm/tcpm.c:728:52: error: expected ';' after expression
strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
^
;
1 error generated.
vim +728 drivers/usb/typec/tcpm/tcpm.c
706
707 __printf(2, 0)
708 static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
709 {
710 char tmpbuffer[LOG_BUFFER_ENTRY_SIZE];
711 u64 ts_nsec = local_clock();
712 unsigned long rem_nsec;
713
714 mutex_lock(&port->logbuffer_lock);
715 if (!port->logbuffer[port->logbuffer_head]) {
716 port->logbuffer[port->logbuffer_head] =
717 kzalloc(LOG_BUFFER_ENTRY_SIZE, GFP_KERNEL);
718 if (!port->logbuffer[port->logbuffer_head]) {
719 mutex_unlock(&port->logbuffer_lock);
720 return;
721 }
722 }
723
724 vsnprintf(tmpbuffer, sizeof(tmpbuffer), fmt, args);
725
726 if (tcpm_log_full(port)) {
727 port->logbuffer_head = max(port->logbuffer_head - 1, 0);
> 728 strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
729 }
730
731 if (port->logbuffer_head < 0 ||
732 port->logbuffer_head >= LOG_BUFFER_ENTRIES) {
733 dev_warn(port->dev,
734 "Bad log buffer index %d\n", port->logbuffer_head);
735 goto abort;
736 }
737
738 if (!port->logbuffer[port->logbuffer_head]) {
739 dev_warn(port->dev,
740 "Log buffer index %d is NULL\n", port->logbuffer_head);
741 goto abort;
742 }
743
744 rem_nsec = do_div(ts_nsec, 1000000000);
745 scnprintf(port->logbuffer[port->logbuffer_head],
746 LOG_BUFFER_ENTRY_SIZE, "[%5lu.%06lu] %s",
747 (unsigned long)ts_nsec, rem_nsec / 1000,
748 tmpbuffer);
749 port->logbuffer_head = (port->logbuffer_head + 1) % LOG_BUFFER_ENTRIES;
750
751 abort:
752 mutex_unlock(&port->logbuffer_lock);
753 }
754
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
2026-04-23 19:23 ` Amit Sunil Dhamne
2026-04-23 20:56 ` Maxwell Doose
@ 2026-04-29 8:54 ` David Laight
1 sibling, 0 replies; 6+ messages in thread
From: David Laight @ 2026-04-29 8:54 UTC (permalink / raw)
To: Amit Sunil Dhamne
Cc: Maxwell Doose, badhri, heikki.krogerus, gregkh, linux-usb,
linux-kernel
On Thu, 23 Apr 2026 12:23:09 -0700
Amit Sunil Dhamne <amitsd@google.com> wrote:
> Hi Maxwell,
>
> On 4/19/26 2:36 PM, Maxwell Doose wrote:
> > The function strcpy() is deprecated as it can be used in buffer overflow
> > attacks. This patch replaces strcpy() with strscpy() to improve
> > security and stability.
> >
> > Signed-off-by: Maxwell Doose <m32285159@gmail.com>
> > ---
> > drivers/usb/typec/tcpm/tcpm.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> > index 8e0e14a2704e..69574c5e79e1 100644
> > --- a/drivers/usb/typec/tcpm/tcpm.c
> > +++ b/drivers/usb/typec/tcpm/tcpm.c
> > @@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
> >
> > if (tcpm_log_full(port)) {
> > port->logbuffer_head = max(port->logbuffer_head - 1, 0);
> > - strcpy(tmpbuffer, "overflow");
> > + strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
> > }
> >
> > if (port->logbuffer_head < 0 ||
> > @@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
> > pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
> > pdo_spr_avs_apdo_src_peak_current(pdo));
> > else
> > - strcpy(msg, "undefined APDO");
> > + strscpy(msg, "undefined APDO", sizeof(msg));
> > break;
> > default:
> > - strcpy(msg, "undefined");
> > + strscpy(msg, "undefined", sizeof(msg));
> > break;
> > }
> > tcpm_log(port, " PDO %d: type %d, %s",
>
> This has already been fixed as part of [1].
It is also 'not a fix'.
strcpy() is fine for copying literal strings into arrays.
With the kernel headers you get a compile error from strcpy() if the string
is too long.
OTOH strscpy() will truncate overlong strings.
David
>
> [1] https://patch.msgid.link/20260310094434.3639602-5-aichao@kylinos.cn
>
>
> BR,
>
> Amit
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-04-29 8:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-19 21:36 [PATCH] usb: typec: tcpm: replace strcpy with strscpy Maxwell Doose
2026-04-23 19:23 ` Amit Sunil Dhamne
2026-04-23 20:56 ` Maxwell Doose
2026-04-29 8:54 ` David Laight
2026-04-27 23:01 ` kernel test robot
2026-04-28 23:11 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox