| Message ID | 20231116191452.work.902-kees@kernel.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 2d1803ada2e021b9333b8a784c55fe828ab2b985 |
| Headers | show |
| Series | usb: gadget: f_midi: Replace strlcpy() with strscpy() | expand |
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c index 5335845d697b..20c6fbd94f32 100644 --- a/drivers/usb/gadget/function/f_midi.c +++ b/drivers/usb/gadget/function/f_midi.c @@ -1177,11 +1177,11 @@ F_MIDI_OPT(out_ports, true, MAX_PORTS); static ssize_t f_midi_opts_id_show(struct config_item *item, char *page) { struct f_midi_opts *opts = to_f_midi_opts(item); - int result; + ssize_t result; mutex_lock(&opts->lock); if (opts->id) { - result = strlcpy(page, opts->id, PAGE_SIZE); + result = strscpy(page, opts->id, PAGE_SIZE); } else { page[0] = 0; result = 0;
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated[1]. Additionally, it returns the size of the source string, not the resulting size of the destination string. In an effort to remove strlcpy() completely[2], replace strlcpy() here with strscpy(). In the unlikely (impossible?) case where opts->id was larger than PAGE_SIZE, this will now correctly report truncation errors. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1] Link: https://github.com/KSPP/linux/issues/89 [2] Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Will McVicker <willmcvicker@google.com> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: Peter Chen <peter.chen@nxp.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Zhang Qilong <zhangqilong3@huawei.com> Cc: Linyu Yuan <quic_linyyuan@quicinc.com> Cc: John Keeping <john@keeping.me.uk> Cc: Azeem Shaikh <azeemshaikh38@gmail.com> Cc: linux-usb@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/usb/gadget/function/f_midi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)