Hello Kees, Martin, James, On Thu, Nov 30, 2023 at 12:41:00PM -0800, Kees Cook wrote: > strlcpy() reads the entire source buffer first. This read may exceed > the destination size limit. This is both inefficient and can lead > to linear read overflows if a source string is not NUL-terminated[1]. > Additionally, it returns the size of the source string, not the > resulting size of the destination string. In an effort to remove strlcpy() > completely[2], replace strlcpy() here with strscpy(). > > Overflow should be impossible here, but actually check for buffer sizes > being identical with BUILD_BUG_ON(), and include a run-time check as > well. > > Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy > [1] > Link: https://github.com/KSPP/linux/issues/89 [2]
> --- > drivers/s390/scsi/zfcp_fc.c | 15 +++++++++++++-- > 1 file changed, 13 insertions(+), 2 deletions(-) > > diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c > index 4f0d0e55f0d4..d6516ab00437 100644 > --- a/drivers/s390/scsi/zfcp_fc.c > +++ b/drivers/s390/scsi/zfcp_fc.c > @@ -900,8 +900,19 @@ static void zfcp_fc_rspn(struct zfcp_adapter *adapter, > zfcp_fc_ct_ns_init(&rspn_req->ct_hdr, FC_NS_RSPN_ID, > FC_SYMBOLIC_NAME_SIZE); > hton24(rspn_req->rspn.fr_fid.fp_fid, fc_host_port_id(shost)); > - len = strlcpy(rspn_req->rspn.fr_name, fc_host_symbolic_name(shost), > - FC_SYMBOLIC_NAME_SIZE); > + > + BUILD_BUG_ON(sizeof(rspn_req->name) != > + sizeof(fc_host_symbolic_name(shost))); > + BUILD_BUG_ON(sizeof(rspn_req->name) != > + type_max(typeof(rspn_req->rspn.fr_name_len)) + 1); > + len = strscpy(rspn_req->name, fc_host_symbolic_name(shost), > + sizeof(rspn_req->name)); > + /* > + * It should be impossible for this to truncate (see BUILD_BUG_ON() > + * above), but be robust anyway. > + */ > + if (WARN_ON(len < 0)) > + len = sizeof(rspn_req->name) - 1; Looks good to me. Acked-by: Benjamin Block <bbl...@linux.ibm.com> > rspn_req->rspn.fr_name_len = len; Martin, James, can you please pick this up for the v6.8 queue? -- Best Regards, Benjamin Block / Linux on IBM Z Kernel Development IBM Deutschland Research & Development GmbH / https://www.ibm.com/privacy Vors. Aufs.-R.: Gregor Pillen / Geschäftsführung: David Faller Sitz der Ges.: Böblingen / Registergericht: AmtsG Stuttgart, HRB 243294
