[PATCH net-next] bnxt_en: Fix strcpy() warnings in bnxt_ethtool.c

[PATCH net-next] bnxt_en: Fix strcpy() warnings in bnxt_ethtool.c

[Michael Chan]

From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>

This patch fixes following smatch warnings:

drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2826 bnxt_fill_coredump_seg_hdr() error: strcpy() '"sEgM"' too large for 'seg_hdr->signature' (5 vs 4)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2858 bnxt_fill_coredump_record() error: strcpy() '"cOrE"' too large for 'record->signature' (5 vs 4)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2879 bnxt_fill_coredump_record() error: strcpy() 'utsname()->sysname' too large for 'record->os_name' (65 vs 32)

Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index b6dbc3f..d6f3289 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2823,7 +2823,7 @@ bnxt_fill_coredump_seg_hdr(struct bnxt *bp,
 			   int status, u32 duration, u32 instance)
 {
 	memset(seg_hdr, 0, sizeof(*seg_hdr));
-	strcpy(seg_hdr->signature, "sEgM");
+	memcpy(seg_hdr->signature, "sEgM", 4);
 	if (seg_rec) {
 		seg_hdr->component_id = (__force __le32)seg_rec->component_id;
 		seg_hdr->segment_id = (__force __le32)seg_rec->segment_id;
@@ -2855,7 +2855,7 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
 
 	time64_to_tm(start, 0, &tm);
 	memset(record, 0, sizeof(*record));
-	strcpy(record->signature, "cOrE");
+	memcpy(record->signature, "cOrE", 4);
 	record->flags = 0;
 	record->low_version = 0;
 	record->high_version = 1;
@@ -2876,7 +2876,7 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
 	record->os_ver_major = cpu_to_le32(os_ver_major);
 	record->os_ver_minor = cpu_to_le32(os_ver_minor);
 
-	strcpy(record->os_name, utsname()->sysname);
+	strncpy(record->os_name, utsname()->sysname, 32);
 	time64_to_tm(end, 0, &tm);
 	record->end_year = cpu_to_le16(tm.tm_year + 1900);
 	record->end_month = cpu_to_le16(tm.tm_mon + 1);
-- 
2.5.1

Re: [PATCH net-next] bnxt_en: Fix strcpy() warnings in bnxt_ethtool.c

[David Miller]

From: Michael Chan <michael.chan@broadcom.com>
Date: Fri, 10 Aug 2018 17:02:12 -0400

> From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
> 
> This patch fixes following smatch warnings:
> 
> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2826 bnxt_fill_coredump_seg_hdr() error: strcpy() '"sEgM"' too large for 'seg_hdr->signature' (5 vs 4)
> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2858 bnxt_fill_coredump_record() error: strcpy() '"cOrE"' too large for 'record->signature' (5 vs 4)
> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2879 bnxt_fill_coredump_record() error: strcpy() 'utsname()->sysname' too large for 'record->os_name' (65 vs 32)
> 
> Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
> Signed-off-by: Michael Chan <michael.chan@broadcom.com>

Applied, thanks Michael.

Re: [PATCH net-next] bnxt_en: Fix strcpy() warnings in bnxt_ethtool.c

[David Miller]

From: David Miller <davem@davemloft.net>
Date: Fri, 10 Aug 2018 14:35:45 -0700 (PDT)

> From: Michael Chan <michael.chan@broadcom.com>
> Date: Fri, 10 Aug 2018 17:02:12 -0400
> 
>> From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
>> 
>> This patch fixes following smatch warnings:
>> 
>> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2826 bnxt_fill_coredump_seg_hdr() error: strcpy() '"sEgM"' too large for 'seg_hdr->signature' (5 vs 4)
>> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2858 bnxt_fill_coredump_record() error: strcpy() '"cOrE"' too large for 'record->signature' (5 vs 4)
>> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2879 bnxt_fill_coredump_record() error: strcpy() 'utsname()->sysname' too large for 'record->os_name' (65 vs 32)
>> 
>> Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>> Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
>> Signed-off-by: Michael Chan <michael.chan@broadcom.com>
> 
> Applied, thanks Michael.

Actually, I'm reverting, this may fix those three warnings, but they are replaced with
a new one:

./include/linux/string.h:246:9: warning: ‘__builtin_strncpy’ output may be truncated copying 32 bytes from a string of length 64 [-Wstringop-truncation]

Sorry.

Re: [PATCH net-next] bnxt_en: Fix strcpy() warnings in bnxt_ethtool.c

[Michael Chan]

On Fri, Aug 10, 2018 at 2:37 PM, David Miller <davem@davemloft.net> wrote:
> From: David Miller <davem@davemloft.net>
> Date: Fri, 10 Aug 2018 14:35:45 -0700 (PDT)
>
>> From: Michael Chan <michael.chan@broadcom.com>
>> Date: Fri, 10 Aug 2018 17:02:12 -0400
>>
>>> From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
>>>
>>> This patch fixes following smatch warnings:
>>>
>>> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2826 bnxt_fill_coredump_seg_hdr() error: strcpy() '"sEgM"' too large for 'seg_hdr->signature' (5 vs 4)
>>> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2858 bnxt_fill_coredump_record() error: strcpy() '"cOrE"' too large for 'record->signature' (5 vs 4)
>>> drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2879 bnxt_fill_coredump_record() error: strcpy() 'utsname()->sysname' too large for 'record->os_name' (65 vs 32)
>>>
>>> Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
>>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
>>> Signed-off-by: Michael Chan <michael.chan@broadcom.com>
>>
>> Applied, thanks Michael.
>
> Actually, I'm reverting, this may fix those three warnings, but they are replaced with
> a new one:
>
> ./include/linux/string.h:246:9: warning: ‘__builtin_strncpy’ output may be truncated copying 32 bytes from a string of length 64 [-Wstringop-truncation]
>

OK.  I'm guessing strlcpy() is the right variant to use here.  I will
repost v2 using strlcpy().  Thanks.