Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
scsi: bfa: Replace all non-returning strlcpy() with strscpy()
strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated [1]. In an effort
to remove strlcpy() completely [2], replace strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89
Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
Link: https://lore.kernel.org/r/20230516013345.723623-1-azeemshaikh38@gmail.com
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
authored by
Azeem Shaikh
and committed by
Martin K. Petersen
973464fd
8759924d
+25
-25
+2
-2
drivers/scsi/bfa/bfa_fcbuild.c
+2
-2
drivers/scsi/bfa/bfa_fcbuild.c
···
1134
1134
memset(rspnid, 0, sizeof(struct fcgs_rspnid_req_s));
1135
1135
1136
1136
rspnid->dap = s_id;
1137
-
strlcpy(rspnid->spn, name, sizeof(rspnid->spn));
1137
+
strscpy(rspnid->spn, name, sizeof(rspnid->spn));
1138
1138
rspnid->spn_len = (u8) strlen(rspnid->spn);
1139
1139
1140
1140
return sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s);
···
1155
1155
memset(rsnn_nn, 0, sizeof(struct fcgs_rsnn_nn_req_s));
1156
1156
1157
1157
rsnn_nn->node_name = node_name;
1158
-
strlcpy(rsnn_nn->snn, name, sizeof(rsnn_nn->snn));
1158
+
strscpy(rsnn_nn->snn, name, sizeof(rsnn_nn->snn));
1159
1159
rsnn_nn->snn_len = (u8) strlen(rsnn_nn->snn);
1160
1160
1161
1161
return sizeof(struct fcgs_rsnn_nn_req_s) + sizeof(struct ct_hdr_s);
+2
-2
drivers/scsi/bfa/bfa_fcs.c
+2
-2
drivers/scsi/bfa/bfa_fcs.c
···
761
761
bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
762
762
763
763
/* Model name/number */
764
-
strlcpy(port_cfg->sym_name.symname, model,
764
+
strscpy(port_cfg->sym_name.symname, model,
765
765
BFA_SYMNAME_MAXLEN);
766
766
strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
767
767
BFA_SYMNAME_MAXLEN);
···
822
822
bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
823
823
824
824
/* Model name/number */
825
-
strlcpy(port_cfg->node_sym_name.symname, model,
825
+
strscpy(port_cfg->node_sym_name.symname, model,
826
826
BFA_SYMNAME_MAXLEN);
827
827
strlcat(port_cfg->node_sym_name.symname,
828
828
BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+10
-10
drivers/scsi/bfa/bfa_fcs_lport.c
+10
-10
drivers/scsi/bfa/bfa_fcs_lport.c
···
2642
2642
bfa_ioc_get_adapter_fw_ver(&port->fcs->bfa->ioc,
2643
2643
hba_attr->fw_version);
2644
2644
2645
-
strlcpy(hba_attr->driver_version, (char *)driver_info->version,
2645
+
strscpy(hba_attr->driver_version, (char *)driver_info->version,
2646
2646
sizeof(hba_attr->driver_version));
2647
2647
2648
-
strlcpy(hba_attr->os_name, driver_info->host_os_name,
2648
+
strscpy(hba_attr->os_name, driver_info->host_os_name,
2649
2649
sizeof(hba_attr->os_name));
2650
2650
2651
2651
/*
···
2663
2663
bfa_fcs_fdmi_get_portattr(fdmi, &fcs_port_attr);
2664
2664
hba_attr->max_ct_pyld = fcs_port_attr.max_frm_size;
2665
2665
2666
-
strlcpy(hba_attr->node_sym_name.symname,
2666
+
strscpy(hba_attr->node_sym_name.symname,
2667
2667
port->port_cfg.node_sym_name.symname, BFA_SYMNAME_MAXLEN);
2668
2668
strcpy(hba_attr->vendor_info, "QLogic");
2669
2669
hba_attr->num_ports =
2670
2670
cpu_to_be32(bfa_ioc_get_nports(&port->fcs->bfa->ioc));
2671
2671
hba_attr->fabric_name = port->fabric->lps->pr_nwwn;
2672
-
strlcpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN);
2672
+
strscpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN);
2673
2673
2674
2674
}
2675
2675
···
2736
2736
/*
2737
2737
* OS device Name
2738
2738
*/
2739
-
strlcpy(port_attr->os_device_name, driver_info->os_device_name,
2739
+
strscpy(port_attr->os_device_name, driver_info->os_device_name,
2740
2740
sizeof(port_attr->os_device_name));
2741
2741
2742
2742
/*
2743
2743
* Host name
2744
2744
*/
2745
-
strlcpy(port_attr->host_name, driver_info->host_machine_name,
2745
+
strscpy(port_attr->host_name, driver_info->host_machine_name,
2746
2746
sizeof(port_attr->host_name));
2747
2747
2748
2748
port_attr->node_name = bfa_fcs_lport_get_nwwn(port);
2749
2749
port_attr->port_name = bfa_fcs_lport_get_pwwn(port);
2750
2750
2751
-
strlcpy(port_attr->port_sym_name.symname,
2751
+
strscpy(port_attr->port_sym_name.symname,
2752
2752
bfa_fcs_lport_get_psym_name(port).symname, BFA_SYMNAME_MAXLEN);
2753
2753
bfa_fcs_lport_get_attr(port, &lport_attr);
2754
2754
port_attr->port_type = cpu_to_be32(lport_attr.port_type);
···
3229
3229
rsp_str[gmal_entry->len-1] = 0;
3230
3230
3231
3231
/* copy IP Address to fabric */
3232
-
strlcpy(bfa_fcs_lport_get_fabric_ipaddr(port),
3232
+
strscpy(bfa_fcs_lport_get_fabric_ipaddr(port),
3233
3233
gmal_entry->ip_addr,
3234
3234
BFA_FCS_FABRIC_IPADDR_SZ);
3235
3235
break;
···
4667
4667
* to that of the base port.
4668
4668
*/
4669
4669
4670
-
strlcpy(symbl,
4670
+
strscpy(symbl,
4671
4671
(char *)&(bfa_fcs_lport_get_psym_name
4672
4672
(bfa_fcs_get_base_port(port->fcs))),
4673
4673
sizeof(symbl));
···
5194
5194
* For Vports, we append the vport's port symbolic name
5195
5195
* to that of the base port.
5196
5196
*/
5197
-
strlcpy(symbl, (char *)&(bfa_fcs_lport_get_psym_name
5197
+
strscpy(symbl, (char *)&(bfa_fcs_lport_get_psym_name
5198
5198
(bfa_fcs_get_base_port(port->fcs))),
5199
5199
sizeof(symbl));
5200
5200
+1
-1
drivers/scsi/bfa/bfa_ioc.c
+1
-1
drivers/scsi/bfa/bfa_ioc.c
···
2788
2788
bfa_ioc_get_adapter_manufacturer(struct bfa_ioc_s *ioc, char *manufacturer)
2789
2789
{
2790
2790
memset((void *)manufacturer, 0, BFA_ADAPTER_MFG_NAME_LEN);
2791
-
strlcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
2791
+
strscpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
2792
2792
}
2793
2793
2794
2794
void
+1
-1
drivers/scsi/bfa/bfa_svc.c
+1
-1
drivers/scsi/bfa/bfa_svc.c
···
330
330
lp.eid = event;
331
331
lp.log_type = BFA_PL_LOG_TYPE_STRING;
332
332
lp.misc = misc;
333
-
strlcpy(lp.log_entry.string_log, log_str,
333
+
strscpy(lp.log_entry.string_log, log_str,
334
334
BFA_PL_STRING_LOG_SZ);
335
335
lp.log_entry.string_log[BFA_PL_STRING_LOG_SZ - 1] = '\0';
336
336
bfa_plog_add(plog, &lp);
+5
-5
drivers/scsi/bfa/bfad.c
+5
-5
drivers/scsi/bfa/bfad.c
···
965
965
966
966
/* Fill the driver_info info to fcs*/
967
967
memset(&driver_info, 0, sizeof(driver_info));
968
-
strlcpy(driver_info.version, BFAD_DRIVER_VERSION,
968
+
strscpy(driver_info.version, BFAD_DRIVER_VERSION,
969
969
sizeof(driver_info.version));
970
970
if (host_name)
971
-
strlcpy(driver_info.host_machine_name, host_name,
971
+
strscpy(driver_info.host_machine_name, host_name,
972
972
sizeof(driver_info.host_machine_name));
973
973
if (os_name)
974
-
strlcpy(driver_info.host_os_name, os_name,
974
+
strscpy(driver_info.host_os_name, os_name,
975
975
sizeof(driver_info.host_os_name));
976
976
if (os_patch)
977
-
strlcpy(driver_info.host_os_patch, os_patch,
977
+
strscpy(driver_info.host_os_patch, os_patch,
978
978
sizeof(driver_info.host_os_patch));
979
979
980
-
strlcpy(driver_info.os_device_name, bfad->pci_name,
980
+
strscpy(driver_info.os_device_name, bfad->pci_name,
981
981
sizeof(driver_info.os_device_name));
982
982
983
983
/* FCS driver info init */
+1
-1
drivers/scsi/bfa/bfad_attr.c
+1
-1
drivers/scsi/bfa/bfad_attr.c
···
834
834
char symname[BFA_SYMNAME_MAXLEN];
835
835
836
836
bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr);
837
-
strlcpy(symname, port_attr.port_cfg.sym_name.symname,
837
+
strscpy(symname, port_attr.port_cfg.sym_name.symname,
838
838
BFA_SYMNAME_MAXLEN);
839
839
return sysfs_emit(buf, "%s\n", symname);
840
840
}
+2
-2
drivers/scsi/bfa/bfad_bsg.c
+2
-2
drivers/scsi/bfa/bfad_bsg.c
···
119
119
120
120
/* fill in driver attr info */
121
121
strcpy(iocmd->ioc_attr.driver_attr.driver, BFAD_DRIVER_NAME);
122
-
strlcpy(iocmd->ioc_attr.driver_attr.driver_ver,
122
+
strscpy(iocmd->ioc_attr.driver_attr.driver_ver,
123
123
BFAD_DRIVER_VERSION, BFA_VERSION_LEN);
124
124
strcpy(iocmd->ioc_attr.driver_attr.fw_ver,
125
125
iocmd->ioc_attr.adapter_attr.fw_ver);
···
307
307
iocmd->attr.port_type = port_attr.port_type;
308
308
iocmd->attr.loopback = port_attr.loopback;
309
309
iocmd->attr.authfail = port_attr.authfail;
310
-
strlcpy(iocmd->attr.port_symname.symname,
310
+
strscpy(iocmd->attr.port_symname.symname,
311
311
port_attr.port_cfg.sym_name.symname,
312
312
sizeof(iocmd->attr.port_symname.symname));
313
313
+1
-1
drivers/scsi/bfa/bfad_im.c
+1
-1
drivers/scsi/bfa/bfad_im.c
···
1046
1046
/* For fibre channel services type 0x20 */
1047
1047
fc_host_supported_fc4s(host)[7] = 1;
1048
1048
1049
-
strlcpy(symname, bfad->bfa_fcs.fabric.bport.port_cfg.sym_name.symname,
1049
+
strscpy(symname, bfad->bfa_fcs.fabric.bport.port_cfg.sym_name.symname,
1050
1050
BFA_SYMNAME_MAXLEN);
1051
1051
sprintf(fc_host_symbolic_name(host), "%s", symname);
1052
1052