| Message ID | 20230530155745.343032-1-azeemshaikh38@gmail.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 73be26b12dfd209e136da01dd7eefc85adc4df8d |
| Headers | show |
| Series | scsi: lpfc: Replace all non-returning strlcpy with strscpy | expand |
Hi Azeem, Looks good. Reviewed-by: Justin Tee <justin.tee@broadcom.com> Thanks, Justin On Tue, May 30, 2023 at 8:59 AM Azeem Shaikh <azeemshaikh38@gmail.com> wrote: > > strlcpy() reads the entire source buffer first. > This read may exceed the destination size limit. > This is both inefficient and can lead to linear read > overflows if a source string is not NUL-terminated [1]. > In an effort to remove strlcpy() completely [2], replace > strlcpy() here with strscpy(). > No return values were used, so direct replacement is safe. > > [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy > [2] https://github.com/KSPP/linux/issues/89 > > Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> > --- > drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c > index 5ba3a9ad9501..239a6537b987 100644 > --- a/drivers/scsi/lpfc/lpfc_hbadisc.c > +++ b/drivers/scsi/lpfc/lpfc_hbadisc.c > @@ -4835,7 +4835,7 @@ lpfc_nlp_state_name(char *buffer, size_t size, int state) > }; > > if (state < NLP_STE_MAX_STATE && states[state]) > - strlcpy(buffer, states[state], size); > + strscpy(buffer, states[state], size); > else > snprintf(buffer, size, "unknown (%d)", state); > return buffer; >
Azeem, > strlcpy() reads the entire source buffer first. This read may exceed > the destination size limit. This is both inefficient and can lead to > linear read overflows if a source string is not NUL-terminated [1]. In > an effort to remove strlcpy() completely [2], replace strlcpy() here > with strscpy(). No return values were used, so direct replacement is > safe. Applied to 6.5/scsi-staging, thanks!
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c index 5ba3a9ad9501..239a6537b987 100644 --- a/drivers/scsi/lpfc/lpfc_hbadisc.c +++ b/drivers/scsi/lpfc/lpfc_hbadisc.c @@ -4835,7 +4835,7 @@ lpfc_nlp_state_name(char *buffer, size_t size, int state) }; if (state < NLP_STE_MAX_STATE && states[state]) - strlcpy(buffer, states[state], size); + strscpy(buffer, states[state], size); else snprintf(buffer, size, "unknown (%d)", state); return buffer;
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> --- drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)