mirrors/scst
1
0
Fork 0
mirror of https://github.com/SCST-project/scst.git synced 2026-05-14 09:11:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

qla2x00t-32gbit: Avoid possible run-time warning with long model_num

Browse Source 
The prior strlcpy() replacement of strncpy() here (which was
later replaced with strscpy()) expected pinfo->model_num (and
pinfo->model_description) to be NUL-terminated, but it is possible
it was not, as the code pattern here shows vha->hw->model_number (and
vha->hw->model_desc) being exactly 1 character larger, and the replaced
strncpy() was copying only up to the size of the source character
array. Replace this with memtostr(), which is the unambiguous way to
convert a maybe not-NUL-terminated character array into a NUL-terminated
string.

Fixes: 527e9b704c3d ("scsi: qla2xxx: Use memcpy() and strlcpy() instead of strcpy() and strncpy()")
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Link: https://lore.kernel.org/r/20240410023155.2100422-5-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>
[ commit c3408c4ae041 upstream ]
This commit is contained in:
Gleb Chesnokov
2024-07-15 11:20:40 +03:00
parent d776e70d5c
commit ceba304d08
2 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
qla2x00t-32gbit/qla_mr.c
View File

@@ -1919,10 +1919,8 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type)
if (fx_type == FXDISC_GET_CONFIG_INFO) {
struct config_info_data *pinfo =
(struct config_info_data *) fdisc->u.fxiocb.rsp_addr;
strscpy(vha->hw->model_number, pinfo->model_num,
ARRAY_SIZE(vha->hw->model_number));
strscpy(vha->hw->model_desc, pinfo->model_description,
ARRAY_SIZE(vha->hw->model_desc));
memtostr(vha->hw->model_number, pinfo->model_num);
memtostr(vha->hw->model_desc, pinfo->model_description);
memcpy(&vha->hw->mr.symbolic_name, pinfo->symbolic_name,
sizeof(vha->hw->mr.symbolic_name));
memcpy(&vha->hw->mr.serial_num, pinfo->serial_num,

19
scst/include/backport.h
View File

@@ -1510,6 +1510,25 @@ static inline ssize_t strscpy(char *dest, const char *src, size_t count)
}
#endif
#ifndef memtostr
/*
* See also commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") # v6.10.
*/
#define memtostr(dest, src) do { \
const size_t _dest_len = __builtin_object_size(dest, 1); \
const size_t _src_len = __builtin_object_size(src, 1); \
const size_t _src_chars = strnlen(src, _src_len); \
const size_t _copy_len = min(_dest_len - 1, _src_chars); \
\
BUILD_BUG_ON(!__builtin_constant_p(_dest_len) || \
!__builtin_constant_p(_src_len) || \
_dest_len == 0 || _dest_len == (size_t)-1 || \
_src_len == 0 || _src_len == (size_t)-1); \
memcpy(dest, src, _copy_len); \
dest[_copy_len] = '\0'; \
} while (0)
#endif
/* <linux/sysfs.h> */
#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0) && \