@@ -1041,9 +1041,8 @@ static int pqi_write_driver_version_to_host_wellness(
buffer->driver_version_tag[1] = 'V';
put_unaligned_le16(sizeof(buffer->driver_version),
&buffer->driver_version_length);
- strncpy(buffer->driver_version, "Linux " DRIVER_VERSION,
- sizeof(buffer->driver_version) - 1);
- buffer->driver_version[sizeof(buffer->driver_version) - 1] = '\0';
+ strscpy(buffer->driver_version, "Linux " DRIVER_VERSION,
+ sizeof(buffer->driver_version));
buffer->dont_write_tag[0] = 'D';
buffer->dont_write_tag[1] = 'W';
buffer->end_tag[0] = 'Z';
buffer->driver_version is sized 32: | struct bmic_host_wellness_driver_version { | ... | char driver_version[32]; ... the source string "Linux " + DRIVER_VERISON is sized at 16. There's really no bug in the existing code since the buffers are sized appropriately with great care taken to manually NUL-terminate the destination buffer. Nonetheless, let's make the swap over to strscpy() for robustness' (and readability's) sake. Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Justin Stitt <justinstitt@google.com> --- drivers/scsi/smartpqi/smartpqi_init.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)