From patchwork Tue May 16 02:54:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Azeem Shaikh X-Patchwork-Id: 13242493 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EAD56C77B75 for ; Tue, 16 May 2023 02:54:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229835AbjEPCyS (ORCPT ); Mon, 15 May 2023 22:54:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229803AbjEPCyQ (ORCPT ); Mon, 15 May 2023 22:54:16 -0400 Received: from mail-il1-x131.google.com (mail-il1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4658772A6; Mon, 15 May 2023 19:54:09 -0700 (PDT) Received: by mail-il1-x131.google.com with SMTP id e9e14a558f8ab-3318961b385so4671305ab.1; Mon, 15 May 2023 19:54:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1684205648; x=1686797648; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=dtKA4eT8yj93tAAG41WBzq6N9lG9sUaUVzM+cNzwt40=; b=dxuyT+qbv4dqQFqXMkQkvzY9uDbHAKYJMe6sJF+Bysx7Kc2QD+IYsILNbX7beFcBzp 0CT55qh7u10RYQc0zvn1mhb33zqodA+sJy6d8XYl7r3CydFg1hRDBm/pO07sI1ha9vtF Lv7Y78tGN4EwYh9M3QTPytdzI7J7rc3fIVoaEf+5FV92S43glSdYv3jjkE5ADsAN9aCp Y3Bxk7Cpjt0/IZZb1LBmzXm367HHwjbVIbWt+XiBotil2ycIpNRA0QrxSsC7vYBVUPOB T/REGUpTBqeoyZvPrCV85SF0yRpkYxh/WYzPAUkZyI/dsor6/rgs17Ps93iVTgM56P/1 Z0EQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684205648; x=1686797648; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=dtKA4eT8yj93tAAG41WBzq6N9lG9sUaUVzM+cNzwt40=; b=FV2qJWXQPJMyCcmDWuTwMs/xCgIWt3A8WJI7H3oCbIgaNvQxkcSD9DSU4AjimPtQRT nNuXkv93uM1Fcg8LYu6W0gxI/Amt0upyGW2X5w81rC41FMqCeBifrsJv9A96m9N5AAoI JxRQ7VGDUW976sq0z/T1jf6ap+WA4Rq8CWqQdEiAHu3FvlvJFwB9VRwfdE15EYY4xRHo TXq+ndASdszICi72NgdCtO23Dly7yN38xd3GAF92chEFrNznKtF4AsUUaUIRSg7kB8yS 4lc/41udQgaCvAjhosdX0641D6jhBa1edPQOIJ1gPNQ3kttDSDJqbVZf54zm2+zzEtu+ 5zVA== X-Gm-Message-State: AC+VfDykKYbbPdTNcWtoeEeuquywEuep7BCQQorxPHiynzMn+0jqlbpF AsTHGCjjaIXdl6pljfQYpUA= X-Google-Smtp-Source: ACHHUZ7K3cPbqubQIkjOAz+WA04TCWjc3F+K0Kms7k8utB5Fd+jilycbwjSjLl46bAaWzT0p49OQvQ== X-Received: by 2002:a05:6602:2c4f:b0:76c:4e64:2a20 with SMTP id x15-20020a0566022c4f00b0076c4e642a20mr921907iov.9.1684205648189; Mon, 15 May 2023 19:54:08 -0700 (PDT) Received: from azeems-kspp.c.googlers.com.com (54.70.188.35.bc.googleusercontent.com. [35.188.70.54]) by smtp.gmail.com with ESMTPSA id h2-20020a02b602000000b0041844cb2c2dsm4225712jam.115.2023.05.15.19.54.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 May 2023 19:54:07 -0700 (PDT) From: Azeem Shaikh To: Nilesh Javali , GR-QLogic-Storage-Upstream@marvell.com Cc: linux-hardening@vger.kernel.org, Azeem Shaikh , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, "James E.J. Bottomley" , "Martin K. Petersen" Subject: [PATCH] scsi: qla2xxx: Replace all non-returning strlcpy with strscpy Date: Tue, 16 May 2023 02:54:04 +0000 Message-ID: <20230516025404.2843867-1-azeemshaikh38@gmail.com> X-Mailer: git-send-email 2.40.1.606.ga4b1b128d6-goog MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Reviewed-by: Kees Cook --- drivers/scsi/qla2xxx/qla_init.c | 8 ++++---- drivers/scsi/qla2xxx/qla_mr.c | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index ec0423ec6681..e831d14a4044 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -4861,7 +4861,7 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len, if (use_tbl && ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC && index < QLA_MODEL_NAMES) - strlcpy(ha->model_desc, + strscpy(ha->model_desc, qla2x00_model_name[index * 2 + 1], sizeof(ha->model_desc)); } else { @@ -4869,14 +4869,14 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len, if (use_tbl && ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC && index < QLA_MODEL_NAMES) { - strlcpy(ha->model_number, + strscpy(ha->model_number, qla2x00_model_name[index * 2], sizeof(ha->model_number)); - strlcpy(ha->model_desc, + strscpy(ha->model_desc, qla2x00_model_name[index * 2 + 1], sizeof(ha->model_desc)); } else { - strlcpy(ha->model_number, def, + strscpy(ha->model_number, def, sizeof(ha->model_number)); } } diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c index f726eb8449c5..083f94e43fba 100644 --- a/drivers/scsi/qla2xxx/qla_mr.c +++ b/drivers/scsi/qla2xxx/qla_mr.c @@ -691,7 +691,7 @@ qlafx00_pci_info_str(struct scsi_qla_host *vha, char *str, size_t str_len) struct qla_hw_data *ha = vha->hw; if (pci_is_pcie(ha->pdev)) - strlcpy(str, "PCIe iSA", str_len); + strscpy(str, "PCIe iSA", str_len); return str; } @@ -1850,21 +1850,21 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type) phost_info = &preg_hsi->hsi; memset(preg_hsi, 0, sizeof(struct register_host_info)); phost_info->os_type = OS_TYPE_LINUX; - strlcpy(phost_info->sysname, p_sysid->sysname, + strscpy(phost_info->sysname, p_sysid->sysname, sizeof(phost_info->sysname)); - strlcpy(phost_info->nodename, p_sysid->nodename, + strscpy(phost_info->nodename, p_sysid->nodename, sizeof(phost_info->nodename)); if (!strcmp(phost_info->nodename, "(none)")) ha->mr.host_info_resend = true; - strlcpy(phost_info->release, p_sysid->release, + strscpy(phost_info->release, p_sysid->release, sizeof(phost_info->release)); - strlcpy(phost_info->version, p_sysid->version, + strscpy(phost_info->version, p_sysid->version, sizeof(phost_info->version)); - strlcpy(phost_info->machine, p_sysid->machine, + strscpy(phost_info->machine, p_sysid->machine, sizeof(phost_info->machine)); - strlcpy(phost_info->domainname, p_sysid->domainname, + strscpy(phost_info->domainname, p_sysid->domainname, sizeof(phost_info->domainname)); - strlcpy(phost_info->hostdriver, QLA2XXX_VERSION, + strscpy(phost_info->hostdriver, QLA2XXX_VERSION, sizeof(phost_info->hostdriver)); preg_hsi->utc = (uint64_t)ktime_get_real_seconds(); ql_dbg(ql_dbg_init, vha, 0x0149, @@ -1909,9 +1909,9 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type) if (fx_type == FXDISC_GET_CONFIG_INFO) { struct config_info_data *pinfo = (struct config_info_data *) fdisc->u.fxiocb.rsp_addr; - strlcpy(vha->hw->model_number, pinfo->model_num, + strscpy(vha->hw->model_number, pinfo->model_num, ARRAY_SIZE(vha->hw->model_number)); - strlcpy(vha->hw->model_desc, pinfo->model_description, + strscpy(vha->hw->model_desc, pinfo->model_description, ARRAY_SIZE(vha->hw->model_desc)); memcpy(&vha->hw->mr.symbolic_name, pinfo->symbolic_name, sizeof(vha->hw->mr.symbolic_name));