[v3] scsi: hpsa: Remove deprecated and unnecessary strncpy()

Commit Message

Thorsten Blum Feb. 14, 2025, 11:43 a.m. UTC

While replacing strncpy() with strscpy(), Bart Van Assche pointed out
that the code occurs inside sysfs write callbacks, which already uses
NUL-terminated strings. This allows the string to be passed directly to
sscanf() without requiring a temporary copy.

Remove the deprecated and unnecessary strncpy() and the corresponding
local variables, and pass the buffer buf directly to sscanf().

Replace sscanf() with kstrtoint() to silence checkpatch warnings.

Compile-tested only.

Link: https://github.com/KSPP/linux/issues/90
Cc: [e-mail]
Cc: Kees Cook <[e-mail]>
Cc: David Laight <[e-mail]>
Suggested-by: Bart Van Assche <[e-mail]>
Signed-off-by: Thorsten Blum <[e-mail]>
---
Changes in v2:
- Adjust len to copy the same number of bytes as with strncpy()
- Link to v1: https://lore.kernel.org/r/[e-mail]/

Changes in v3:
- Remove strncpy() and tmpbuf et al and use buf directly as suggested by
  Bart Van Assche and Kees Cook
- Replace sscanf() with kstrtoint() as suggested by David Laight
- Link to v2: https://lore.kernel.org/linux-kernel/[e-mail]/
---
 drivers/scsi/hpsa.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

Comments

Bart Van Assche Feb. 18, 2025, 6:11 p.m. UTC | #1

On 2/14/25 3:43 AM, Thorsten Blum wrote:
> While replacing strncpy() with strscpy(), Bart Van Assche pointed out
> that the code occurs inside sysfs write callbacks, which already uses
> NUL-terminated strings. This allows the string to be passed directly to
> sscanf() without requiring a temporary copy.
> 
> Remove the deprecated and unnecessary strncpy() and the corresponding
> local variables, and pass the buffer buf directly to sscanf().
> 
> Replace sscanf() with kstrtoint() to silence checkpatch warnings.

Reviewed-by: Bart Van Assche <[e-mail]>

Martin K. Petersen Feb. 19, 2025, 1:53 a.m. UTC | #2

Thorsten,

> While replacing strncpy() with strscpy(), Bart Van Assche pointed out
> that the code occurs inside sysfs write callbacks, which already uses
> NUL-terminated strings. This allows the string to be passed directly to
> sscanf() without requiring a temporary copy.

Applied to 6.15/scsi-staging, thanks!

Patch

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 84d8de07b7ae..bb65954b1b1e 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -453,17 +453,13 @@  static ssize_t host_store_hp_ssd_smart_path_status(struct device *dev,
 					 struct device_attribute *attr,
 					 const char *buf, size_t count)
 {
-	int status, len;
+	int status;
 	struct ctlr_info *h;
 	struct Scsi_Host *shost = class_to_shost(dev);
-	char tmpbuf[10];
 
 	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
 		return -EACCES;
-	len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count;
-	strncpy(tmpbuf, buf, len);
-	tmpbuf[len] = '\0';
-	if (sscanf(tmpbuf, "%d", &status) != 1)
+	if (kstrtoint(buf, 10, &status))
 		return -EINVAL;
 	h = shost_to_hba(shost);
 	h->acciopath_status = !!status;
@@ -477,17 +473,13 @@  static ssize_t host_store_raid_offload_debug(struct device *dev,
 					 struct device_attribute *attr,
 					 const char *buf, size_t count)
 {
-	int debug_level, len;
+	int debug_level;
 	struct ctlr_info *h;
 	struct Scsi_Host *shost = class_to_shost(dev);
-	char tmpbuf[10];
 
 	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
 		return -EACCES;
-	len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count;
-	strncpy(tmpbuf, buf, len);
-	tmpbuf[len] = '\0';
-	if (sscanf(tmpbuf, "%d", &debug_level) != 1)
+	if (kstrtoint(buf, 10, &debug_level))
 		return -EINVAL;
 	if (debug_level < 0)
 		debug_level = 0;