Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: libfc: replace deprecated strncpy() with memcpy()

strncpy() is deprecated [1] and as such we should use different apis to
copy string data.

We can see that ct is NUL-initialized with fc_ct_hdr_fill:
| ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn) + len,
...

In fc_ct_hdr_fill():
| memset(ct, 0, ct_plen);

We also calculate the length of the source string:
| len = strnlen(fc_host_symbolic_name(lport->host), 255);

...then this argument is used in strncpy(), which is bad because the
pattern of (dest, src, strlen(src)) usually leaves the destination
buffer without NUL-termination. However, it looks as though we do not
require NUL-termination since fr_name is part of a seq_buf-like
structure wherein its length is monitored:
| struct fc_ns_rspn {
| struct fc_ns_fid fr_fid; /* port ID object */
| __u8 fr_name_len;
| char fr_name[];
| } __attribute__((__packed__));

So, this is really just a byte copy into a length-bounded buffer. Let's use
memcpy().

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20240221-strncpy-drivers-scsi-libfc-fc_encode-h-v2-1-019a0889c5ca@google.com
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Justin Stitt and committed by
Martin K. Petersen
3e24118e e100c01e

+8 -6
+8 -6
drivers/scsi/libfc/fc_encode.h
··· 136 136 break; 137 137 138 138 case FC_NS_RSPN_ID: 139 - len = strnlen(fc_host_symbolic_name(lport->host), 255); 139 + len = strnlen(fc_host_symbolic_name(lport->host), 140 + FC_SYMBOLIC_NAME_SIZE); 140 141 ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn) + len, 141 142 FC_FST_DIR, FC_NS_SUBTYPE); 142 143 hton24(ct->payload.spn.fr_fid.fp_fid, lport->port_id); 143 - strncpy(ct->payload.spn.fr_name, 144 - fc_host_symbolic_name(lport->host), len); 144 + memcpy(ct->payload.spn.fr_name, 145 + fc_host_symbolic_name(lport->host), len); 145 146 ct->payload.spn.fr_name_len = len; 146 147 break; 147 148 148 149 case FC_NS_RSNN_NN: 149 - len = strnlen(fc_host_symbolic_name(lport->host), 255); 150 + len = strnlen(fc_host_symbolic_name(lport->host), 151 + FC_SYMBOLIC_NAME_SIZE); 150 152 ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rsnn) + len, 151 153 FC_FST_DIR, FC_NS_SUBTYPE); 152 154 put_unaligned_be64(lport->wwnn, &ct->payload.snn.fr_wwn); 153 - strncpy(ct->payload.snn.fr_name, 154 - fc_host_symbolic_name(lport->host), len); 155 + memcpy(ct->payload.snn.fr_name, 156 + fc_host_symbolic_name(lport->host), len); 155 157 ct->payload.snn.fr_name_len = len; 156 158 break; 157 159