[PATCH] ncm: allow for NULL terminations

[PATCH] ncm: allow for NULL terminations

[Alan Cox]

From: Alan Cox <alan@linux.intel.com>

The strings are passed to snprintf so must be null terminated. It seems the
copy length is incorrectly set.

Signed-off-by: Alan Cox <alan@linux.intel.com>
---

 drivers/net/usb/cdc_ncm.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 4cd582a..af8cce7 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -145,10 +145,10 @@ cdc_ncm_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
 {
 	struct usbnet *dev = netdev_priv(net);
 
-	strncpy(info->driver, dev->driver_name, sizeof(info->driver));
-	strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+	strncpy(info->driver, dev->driver_name, sizeof(info->driver) - 1);
+	strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
 	strncpy(info->fw_version, dev->driver_info->description,
-		sizeof(info->fw_version));
+		sizeof(info->fw_version) - 1);
 	usb_make_path(dev->udev, info->bus_info, sizeof(info->bus_info));
 }
 

Re: [PATCH] ncm: allow for NULL terminations

[Ben Hutchings]

On Mon, 2012-09-17 at 11:58 +0100, Alan Cox wrote:
> From: Alan Cox <alan@linux.intel.com>
> 
> The strings are passed to snprintf so must be null terminated. It seems the
> copy length is incorrectly set.

Please use strlcpy() instead.  (I thought someone had already gone round
the get_drvinfo implementations and fixed them to do that, actually.)

Ben.

> Signed-off-by: Alan Cox <alan@linux.intel.com>
> ---
> 
>  drivers/net/usb/cdc_ncm.c |    6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
> index 4cd582a..af8cce7 100644
> --- a/drivers/net/usb/cdc_ncm.c
> +++ b/drivers/net/usb/cdc_ncm.c
> @@ -145,10 +145,10 @@ cdc_ncm_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
>  {
>  	struct usbnet *dev = netdev_priv(net);
>  
> -	strncpy(info->driver, dev->driver_name, sizeof(info->driver));
> -	strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
> +	strncpy(info->driver, dev->driver_name, sizeof(info->driver) - 1);
> +	strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
>  	strncpy(info->fw_version, dev->driver_info->description,
> -		sizeof(info->fw_version));
> +		sizeof(info->fw_version) - 1);
>  	usb_make_path(dev->udev, info->bus_info, sizeof(info->bus_info));
>  }
>  
> 

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

Re: [PATCH] ncm: allow for NULL terminations

[Alan Cox]

On Mon, 17 Sep 2012 16:45:24 +0100
Ben Hutchings <bhutchings@solarflare.com> wrote:

> On Mon, 2012-09-17 at 11:58 +0100, Alan Cox wrote:
> > From: Alan Cox <alan@linux.intel.com>
> > 
> > The strings are passed to snprintf so must be null terminated. It seems the
> > copy length is incorrectly set.
> 
> Please use strlcpy() instead.  (I thought someone had already gone round
> the get_drvinfo implementations and fixed them to do that, actually.)

There are still plenty of them. I'm just noting they are one out. I'm
doing a first pass over a whole pile of stuff so if you'd prefer it in a
different form treat it as a note to the maintainer than their code is
buggy as I probably won't be back round to it for a couple of months
judging by the size of the audit pile I'm working down.

Alan

Re: [PATCH] ncm: allow for NULL terminations

[Rick Jones]

On 09/17/2012 08:45 AM, Ben Hutchings wrote:
> On Mon, 2012-09-17 at 11:58 +0100, Alan Cox wrote:
>> From: Alan Cox <alan@linux.intel.com>
>>
>> The strings are passed to snprintf so must be null terminated. It seems the
>> copy length is incorrectly set.
>
> Please use strlcpy() instead.  (I thought someone had already gone round
> the get_drvinfo implementations and fixed them to do that, actually.)

That may have been my "floor sweeping" exercise of before, but I didn't 
go into drivers/net/usb/ at the time.

rick

>
> Ben.
>
>> Signed-off-by: Alan Cox <alan@linux.intel.com>
>> ---
>>
>>   drivers/net/usb/cdc_ncm.c |    6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
>> index 4cd582a..af8cce7 100644
>> --- a/drivers/net/usb/cdc_ncm.c
>> +++ b/drivers/net/usb/cdc_ncm.c
>> @@ -145,10 +145,10 @@ cdc_ncm_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
>>   {
>>   	struct usbnet *dev = netdev_priv(net);
>>
>> -	strncpy(info->driver, dev->driver_name, sizeof(info->driver));
>> -	strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
>> +	strncpy(info->driver, dev->driver_name, sizeof(info->driver) - 1);
>> +	strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
>>   	strncpy(info->fw_version, dev->driver_info->description,
>> -		sizeof(info->fw_version));
>> +		sizeof(info->fw_version) - 1);
>>   	usb_make_path(dev->udev, info->bus_info, sizeof(info->bus_info));
>>   }
>>
>>
>