github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

scsi: target: Replace strncpy() with strscpy() in VPD dump functions

Browse Source 
Replace the deprecated[1] strncpy() with strscpy() in
transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(),
transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().

All four functions follow the same pattern: a local
buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated
via sprintf()/snprintf() (always NUL-terminated), then conditionally
copied to p_buf with strncpy(). The p_buf destination is used as a
C string by all callers in target_core_configfs.c: strlen(buf) and
sprintf(page+len, "%s", buf) to build sysfs output.

NUL-padding is not required: callers in target_core_configfs.c
pre-zero p_buf with memset() or initializer before calling these
functions, and consume p_buf only as a NUL-terminated C string via
strlen() and "%s", never exposing trailing bytes.

No behavioral change: the source buf is always NUL-terminated and
shorter than VPD_TMP_BUF_SIZE, so strscpy() produces identical output.

Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://patch.msgid.link/20260323171311.work.101-kees@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Kees Cook 2026-03-23 10:13:15 -07:00 committed by Martin K. Petersen
parent 6755741890
commit 665fb6a643
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/target/target_core_transport.c
View File

@ -1150,7 +1150,7 @@ void transport_dump_vpd_proto_id(
}
if (p_buf)
strncpy(p_buf, buf, p_buf_len);
strscpy(p_buf, buf, p_buf_len);
else
pr_debug("%s", buf);
}
@ -1200,7 +1200,7 @@ int transport_dump_vpd_assoc(
}
if (p_buf)
strncpy(p_buf, buf, p_buf_len);
strscpy(p_buf, buf, p_buf_len);
else
pr_debug("%s", buf);
@ -1260,7 +1260,7 @@ int transport_dump_vpd_ident_type(
if (p_buf) {
if (p_buf_len < strlen(buf)+1)
return -EINVAL;
strncpy(p_buf, buf, p_buf_len);
strscpy(p_buf, buf, p_buf_len);
} else {
pr_debug("%s", buf);
}
@ -1314,7 +1314,7 @@ int transport_dump_vpd_ident(
}
if (p_buf)
strncpy(p_buf, buf, p_buf_len);
strscpy(p_buf, buf, p_buf_len);
else
pr_debug("%s", buf);