| Message ID | 20231207-strncpy-drivers-net-ethernet-qlogic-qlcnic-qlcnic_83xx_init-c-v2-1-eb1a20a91b2a@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | f8dd2412ba66128de4325c187c9504c6da511bc8 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] qlcnic: replace deprecated strncpy with strscpy | expand |
On Thu, Dec 07, 2023 at 09:42:22PM +0000, Justin Stitt wrote: > strncpy() is deprecated for use on NUL-terminated destination strings > [1] and as such we should prefer more robust and less ambiguous string > interfaces. > > We expect fw_info->fw_file_name to be NUL-terminated based on its use > within _request_firmware_prepare() wherein `name` refers to it: > | if (firmware_request_builtin_buf(firmware, name, dbuf, size)) { > | dev_dbg(device, "using built-in %s\n", name); > | return 0; /* assigned */ > | } > ... and with firmware_request_builtin() also via `name`: > | if (strcmp(name, b_fw->name) == 0) { > > There is no evidence that NUL-padding is required. > > Additionally replace size macro (QLC_FW_FILE_NAME_LEN) with > sizeof(fw_info->fw_file_name) to more directly tie the maximum buffer > size to the destination buffer: > > Considering the above, a suitable replacement is `strscpy` [2] due to > the fact that it guarantees NUL-termination on the destination buffer > without unnecessarily NUL-padding. > > Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] > Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] > Link: https://github.com/KSPP/linux/issues/90 > Cc: linux-hardening@vger.kernel.org > Signed-off-by: Justin Stitt <justinstitt@google.com> Thanks for the refresh! Reviewed-by: Kees Cook <keescook@chromium.org>
Hello: This patch was applied to netdev/net-next.git (main) by David S. Miller <davem@davemloft.net>: On Thu, 07 Dec 2023 21:42:22 +0000 you wrote: > strncpy() is deprecated for use on NUL-terminated destination strings > [1] and as such we should prefer more robust and less ambiguous string > interfaces. > > We expect fw_info->fw_file_name to be NUL-terminated based on its use > within _request_firmware_prepare() wherein `name` refers to it: > | if (firmware_request_builtin_buf(firmware, name, dbuf, size)) { > | dev_dbg(device, "using built-in %s\n", name); > | return 0; /* assigned */ > | } > ... and with firmware_request_builtin() also via `name`: > | if (strcmp(name, b_fw->name) == 0) { > > [...] Here is the summary with links: - [v2] qlcnic: replace deprecated strncpy with strscpy https://git.kernel.org/netdev/net-next/c/f8dd2412ba66 You are awesome, thank you!
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c index c95d56e56c59..b733374b4dc5 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c @@ -2092,8 +2092,8 @@ static int qlcnic_83xx_run_post(struct qlcnic_adapter *adapter) return -EINVAL; } - strncpy(fw_info->fw_file_name, QLC_83XX_POST_FW_FILE_NAME, - QLC_FW_FILE_NAME_LEN); + strscpy(fw_info->fw_file_name, QLC_83XX_POST_FW_FILE_NAME, + sizeof(fw_info->fw_file_name)); ret = request_firmware(&fw_info->fw, fw_info->fw_file_name, dev); if (ret) { @@ -2396,12 +2396,12 @@ static int qlcnic_83xx_get_fw_info(struct qlcnic_adapter *adapter) switch (pdev->device) { case PCI_DEVICE_ID_QLOGIC_QLE834X: case PCI_DEVICE_ID_QLOGIC_QLE8830: - strncpy(fw_info->fw_file_name, QLC_83XX_FW_FILE_NAME, - QLC_FW_FILE_NAME_LEN); + strscpy(fw_info->fw_file_name, QLC_83XX_FW_FILE_NAME, + sizeof(fw_info->fw_file_name)); break; case PCI_DEVICE_ID_QLOGIC_QLE844X: - strncpy(fw_info->fw_file_name, QLC_84XX_FW_FILE_NAME, - QLC_FW_FILE_NAME_LEN); + strscpy(fw_info->fw_file_name, QLC_84XX_FW_FILE_NAME, + sizeof(fw_info->fw_file_name)); break; default: dev_err(&pdev->dev, "%s: Invalid device id\n",
strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. We expect fw_info->fw_file_name to be NUL-terminated based on its use within _request_firmware_prepare() wherein `name` refers to it: | if (firmware_request_builtin_buf(firmware, name, dbuf, size)) { | dev_dbg(device, "using built-in %s\n", name); | return 0; /* assigned */ | } ... and with firmware_request_builtin() also via `name`: | if (strcmp(name, b_fw->name) == 0) { There is no evidence that NUL-padding is required. Additionally replace size macro (QLC_FW_FILE_NAME_LEN) with sizeof(fw_info->fw_file_name) to more directly tie the maximum buffer size to the destination buffer: Considering the above, a suitable replacement is `strscpy` [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt <justinstitt@google.com> --- Changes in v2: - update commit msg with sizeof() rationale (thanks Kees) - rebase onto mainline bee0e7762ad2c602 - Link to v1: https://lore.kernel.org/r/20231012-strncpy-drivers-net-ethernet-qlogic-qlcnic-qlcnic_83xx_init-c-v1-1-f0008d5e43be@google.com --- Note: build-tested only. Found with: $ rg "strncpy\(" --- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- base-commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 change-id: 20231012-strncpy-drivers-net-ethernet-qlogic-qlcnic-qlcnic_83xx_init-c-7858019dc583 Best regards, -- Justin Stitt <justinstitt@google.com>