On Tue, 1 Sep 2026 10:32:41 +0530 Hrushiraj Gandhi <[email protected]> wrote:
> strcpy() has no bound on the destination buffer, so convert this to > the bounded, always-NUL-terminating strscpy() instead. The literal > "BIOS_DATA_BLOCK" (15 chars + NUL) fits the 16-byte signature field > exactly, so this is a no-op change in behaviour. > > No functional change. > > Signed-off-by: Hrushiraj Gandhi <[email protected]> > --- > drivers/gpu/drm/i915/gvt/opregion.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/gvt/opregion.c > b/drivers/gpu/drm/i915/gvt/opregion.c > index d6e76ba31d60..f2527e26cd1e 100644 > --- a/drivers/gpu/drm/i915/gvt/opregion.c > +++ b/drivers/gpu/drm/i915/gvt/opregion.c > @@ -151,7 +151,8 @@ static void virt_vbt_generation(struct vbt *v) > v->header.vbt_size = sizeof(struct vbt); > v->header.bdb_offset = offsetof(struct vbt, bdb_header); > > - strcpy(&v->bdb_header.signature[0], "BIOS_DATA_BLOCK"); > + strscpy(v->bdb_header.signature, "BIOS_DATA_BLOCK", > + sizeof(v->bdb_header.signature)); Pointless and potentially wrong. Both normally reduce to the same memcpy() call. If the fixed string is too long strcpy() generates a compile error whereas strscpy() will silently truncate. (The '&' and '[0]' might need removing.) David > v->bdb_header.version = 186; /* child_dev_size = 33 */ > v->bdb_header.header_size = sizeof(v->bdb_header); > >
