Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: aacraid: Replace all non-returning strlcpy with strscpy

strlcpy() reads the entire source buffer first.
This read may exceed the destination size limit.
This is both inefficient and can lead to linear read
overflows if a source string is not NUL-terminated [1].
In an effort to remove strlcpy() completely [2], replace
strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89

Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230517143049.1519806-1-azeemshaikh38@gmail.com

authored by

Azeem Shaikh and committed by
Kees Cook
038d40ed 8d82557e

+1 -1
+1 -1
drivers/scsi/aacraid/aachba.c
··· 3289 3289 else 3290 3290 qd.unmapped = 0; 3291 3291 3292 - strlcpy(qd.name, fsa_dev_ptr[qd.cnum].devname, 3292 + strscpy(qd.name, fsa_dev_ptr[qd.cnum].devname, 3293 3293 min(sizeof(qd.name), sizeof(fsa_dev_ptr[qd.cnum].devname) + 1)); 3294 3294 3295 3295 if (copy_to_user(arg, &qd, sizeof (struct aac_query_disk)))