Commit 096a8aac authored by Kees Cook's avatar Kees Cook Committed by Linus Torvalds
Browse files

clean up scary strncpy(dst, src, strlen(src)) uses 



Fix various weird constructions of strncpy(dst, src, strlen(src)).

Length limits should be about the space available in the destination,
not repurposed as a method to either always include or always exclude a
trailing NULL byte.  Either the NULL should always be copied (using
strlcpy), or it should not be copied (using something like memcpy).
Readable code should not depend on the weird behavior of strncpy when it
hits the length limit.  Better to avoid the anti-pattern entirely.

[akpm@linux-foundation.org: revert getdelays.c part due to missing bsd/string.h]
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	[staging]
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>	[acpi]
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Ursula Braun <ursula.braun@de.ibm.com>
Cc: Frank Blaschka <blaschka@linux.vnet.ibm.com>
Cc: Richard Weinberger <richard@nod.at>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e7152b97

drivers/acpi/sysfs.c

+1 −2
Original line number Diff line number Diff line
@@ -677,10 +677,9 @@ void acpi_irq_stats_init(void) 
		else

			sprintf(buffer, "bug%02X", i);



		name = kzalloc(strlen(buffer) + 1, GFP_KERNEL);

		name = kstrdup(buffer, GFP_KERNEL);

		if (name == NULL)

			goto fail;

		strncpy(name, buffer, strlen(buffer) + 1);



		sysfs_attr_init(&counter_attrs[i].attr);

		counter_attrs[i].attr.name = name;

drivers/s390/net/qeth_l3_sys.c

+2 −4
Original line number Diff line number Diff line
@@ -315,10 +315,8 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev, 
	if (qeth_configure_cq(card, QETH_CQ_ENABLED))

		return -EPERM;



	for (i = 0; i < 8; i++)

		card->options.hsuid[i] = ' ';

	card->options.hsuid[8] = '\0';

	strncpy(card->options.hsuid, tmp, strlen(tmp));

	snprintf(card->options.hsuid, sizeof(card->options.hsuid),

		 "%-8s", tmp);

	ASCEBC(card->options.hsuid, 8);

	if (card->dev)

		memcpy(card->dev->perm_addr, card->options.hsuid, 9);

drivers/staging/tidspbridge/rmgr/drv_interface.c

+1 −2
Original line number Diff line number Diff line
@@ -421,12 +421,11 @@ static int omap3_bridge_startup(struct platform_device *pdev) 
	drv_datap->tc_wordswapon = tc_wordswapon;



	if (base_img) {

		drv_datap->base_img = kmalloc(strlen(base_img) + 1, GFP_KERNEL);

		drv_datap->base_img = kstrdup(base_img, GFP_KERNEL);

		if (!drv_datap->base_img) {

			err = -ENOMEM;

			goto err2;

		}

		strncpy(drv_datap->base_img, base_img, strlen(base_img) + 1);

	}



	dev_set_drvdata(bridge, drv_datap);

fs/hppfs/hppfs.c

+6 −5
Original line number Diff line number Diff line
@@ -69,7 +69,7 @@ static char *dentry_name(struct dentry *dentry, int extra) 
	struct dentry *parent;

	char *root, *name;

	const char *seg_name;

	int len, seg_len;

	int len, seg_len, root_len;



	len = 0;

	parent = dentry;
@@ -81,7 +81,8 @@ static char *dentry_name(struct dentry *dentry, int extra) 
	}



	root = "proc";

	len += strlen(root);

	root_len = strlen(root);

	len += root_len;

	name = kmalloc(len + extra + 1, GFP_KERNEL);

	if (name == NULL)

		return NULL;
@@ -91,7 +92,7 @@ static char *dentry_name(struct dentry *dentry, int extra) 
	while (parent->d_parent != parent) {

		if (is_pid(parent)) {

			seg_name = "pid";

			seg_len = strlen("pid");

			seg_len = strlen(seg_name);

		}

		else {

			seg_name = parent->d_name.name;
@@ -100,10 +101,10 @@ static char *dentry_name(struct dentry *dentry, int extra) 


		len -= seg_len + 1;

		name[len] = '/';

		strncpy(&name[len + 1], seg_name, seg_len);

		memcpy(&name[len + 1], seg_name, seg_len);

		parent = parent->d_parent;

	}

	strncpy(name, root, strlen(root));

	memcpy(name, root, root_len);

	return name;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE