From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 09/15] netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes
Date: Mon, 14 May 2018 00:36:50 +0200 [thread overview]
Message-ID: <20180513223656.10077-10-pablo@netfilter.org> (raw)
In-Reply-To: <20180513223656.10077-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
fixes these warnings:
'nfnl_cthelper_create' at net/netfilter/nfnetlink_cthelper.c:237:2,
'nfnl_cthelper_new' at net/netfilter/nfnetlink_cthelper.c:450:9:
./include/linux/string.h:246:9: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation]
return __builtin_strncpy(p, q, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Moreover, strncpy assumes null-terminated source buffers, but thats
not the case here.
Unlike strlcpy, nla_strlcpy *does* pad the destination buffer
while also considering nla attribute size.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink_acct.c | 2 +-
net/netfilter/nfnetlink_cthelper.c | 7 ++++---
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index b9505bcd3827..6ddf89183e7b 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
nfacct->flags = flags;
}
- strncpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
+ nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
if (tb[NFACCT_BYTES]) {
atomic64_set(&nfacct->bytes,
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 4a4b293fb2e5..fa026b269b36 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -149,8 +149,8 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
!tb[NFCTH_POLICY_EXPECT_TIMEOUT])
return -EINVAL;
- strncpy(expect_policy->name,
- nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
+ nla_strlcpy(expect_policy->name,
+ nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
expect_policy->max_expected =
ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
@@ -234,7 +234,8 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
if (ret < 0)
goto err1;
- strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
+ nla_strlcpy(helper->name,
+ nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
ret = -ENOMEM;
--
2.11.0
next prev parent reply other threads:[~2018-05-13 22:36 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-13 22:36 [PATCH 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 01/15] netfilter: Fix handling simultaneous open in TCP conntrack Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 02/15] netfilter: x_tables: check name length in find_match/target, too Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 03/15] netfilter: nf_tables: skip synchronize_rcu if transaction log is empty Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 04/15] netfilter: bridge: stp fix reference to uninitialized data Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 05/15] netfilter: nf_tables: nft_compat: fix refcount leak on xt module Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 06/15] ipvs: fix refcount usage for conns in ops mode Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 07/15] ipvs: fix stats update from local clients Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 08/15] netfilter: core: add missing __rcu annotation Pablo Neira Ayuso
2018-05-13 22:36 ` Pablo Neira Ayuso [this message]
2018-05-13 22:36 ` [PATCH 10/15] netfilter: x_tables: add module alias for icmp matches Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 11/15] netfilter: nf_tables: don't assume chain stats are set when jumplabel is set Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 12/15] netfilter: nft_compat: prepare for indirect info storage Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 13/15] netfilter: nft_compat: fix handling of large matchinfo size Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 14/15] netfilter: nf_tables: bogus EBUSY in chain deletions Pablo Neira Ayuso
2018-05-13 22:36 ` [PATCH 15/15] netfilter: nf_tables: fix memory leak on error exit return Pablo Neira Ayuso
2018-05-14 1:05 ` [PATCH 00/15] Netfilter/IPVS fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180513223656.10077-10-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).