* [PATCH v2] nfc: pn544: i2c: Replace strcpy() with strscpy() [not found] <20260225172715.75756-1-tomasz.unger.ref@yahoo.pl> @ 2026-02-25 17:27 ` tomasz.unger 2026-02-26 13:44 ` Simon Horman 2026-02-27 3:30 ` Jakub Kicinski 0 siblings, 2 replies; 3+ messages in thread From: tomasz.unger @ 2026-02-25 17:27 UTC (permalink / raw) To: horms; +Cc: netdev, linux-kernel, Tomasz Unger From: Tomasz Unger <tomasz.unger@yahoo.pl> strcpy() does not limit the number of bytes copied which can lead to buffer overflow when firmware_name is derived from user input via NFC subsystem. This is a bug fix, not a cleanup. Replace with strscpy() which limits the copy to the size of the destination buffer. Since phy->firmware_name is an array, the two-argument variant of strscpy() is used - the compiler deduces the buffer size automatically. Fixes: 06c660340f1e ("NFC: pn544: i2c: Add firmware download implementation for pn544") Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> --- Changes since v1 (requested by Simon Horman <horms@kernel.org>): - Use two-argument strscpy() since phy->firmware_name is an array Testing: - checkpatch.pl: 0 errors, 0 warnings - make drivers/nfc/pn544/: compiled successfully, 0 errors, 0 warnings - Module loaded successfully in QEMU (x86_64) with buildroot: insmod pn544.ko - no errors, confirmed via lsmod drivers/nfc/pn544/i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c index a0dfb3f98d5a..b31b5bef7187 100644 --- a/drivers/nfc/pn544/i2c.c +++ b/drivers/nfc/pn544/i2c.c @@ -526,7 +526,7 @@ static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name, pr_info("Starting Firmware Download (%s)\n", firmware_name); - strcpy(phy->firmware_name, firmware_name); + strscpy(phy->firmware_name, firmware_name); phy->hw_variant = hw_variant; phy->fw_work_state = FW_WORK_STATE_START; -- 2.53.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] nfc: pn544: i2c: Replace strcpy() with strscpy() 2026-02-25 17:27 ` [PATCH v2] nfc: pn544: i2c: Replace strcpy() with strscpy() tomasz.unger @ 2026-02-26 13:44 ` Simon Horman 2026-02-27 3:30 ` Jakub Kicinski 1 sibling, 0 replies; 3+ messages in thread From: Simon Horman @ 2026-02-26 13:44 UTC (permalink / raw) To: tomasz.unger; +Cc: netdev, linux-kernel On Wed, Feb 25, 2026 at 06:27:15PM +0100, tomasz.unger@yahoo.pl wrote: > From: Tomasz Unger <tomasz.unger@yahoo.pl> > > strcpy() does not limit the number of bytes copied which can lead to > buffer overflow when firmware_name is derived from user input via > NFC subsystem. This is a bug fix, not a cleanup. > > Replace with strscpy() which limits the copy to the size of the > destination buffer. Since phy->firmware_name is an array, the > two-argument variant of strscpy() is used - the compiler deduces > the buffer size automatically. > > Fixes: 06c660340f1e ("NFC: pn544: i2c: Add firmware download implementation for pn544") > Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> > --- > Changes since v1 (requested by Simon Horman <horms@kernel.org>): > - Use two-argument strscpy() since phy->firmware_name is an array Thanks for the update. Reviewed-by: Simon Horman <horms@kernel.org> ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] nfc: pn544: i2c: Replace strcpy() with strscpy() 2026-02-25 17:27 ` [PATCH v2] nfc: pn544: i2c: Replace strcpy() with strscpy() tomasz.unger 2026-02-26 13:44 ` Simon Horman @ 2026-02-27 3:30 ` Jakub Kicinski 1 sibling, 0 replies; 3+ messages in thread From: Jakub Kicinski @ 2026-02-27 3:30 UTC (permalink / raw) To: tomasz.unger; +Cc: horms, netdev, linux-kernel On Wed, 25 Feb 2026 18:27:15 +0100 tomasz.unger@yahoo.pl wrote: > This is a bug fix, not a cleanup. Could you include an example path thru which a firmware_name longer than the array can reach the driver? On a quick look the input comes via netlink which sets the max length appropriately. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-02-27 3:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260225172715.75756-1-tomasz.unger.ref@yahoo.pl>
2026-02-25 17:27 ` [PATCH v2] nfc: pn544: i2c: Replace strcpy() with strscpy() tomasz.unger
2026-02-26 13:44 ` Simon Horman
2026-02-27 3:30 ` Jakub Kicinski
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox