From: Azeem Shaikh Date: Wed, 21 Jun 2023 03:00:32 +0000 (+0000) Subject: scsi: ncr53c8xx: Replace strlcpy() with strscpy() X-Git-Tag: v6.5-rc1~15^2~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d1e8a9fbb39292e6666192565b51bbda781f9f04;p=thirdparty%2Fkernel%2Flinux.git scsi: ncr53c8xx: Replace strlcpy() with strscpy() strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Link: https://lore.kernel.org/r/20230621030033.3800351-2-azeemshaikh38@gmail.com Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen --- diff --git a/drivers/scsi/ncr53c8xx.c b/drivers/scsi/ncr53c8xx.c index 4458449c960bf..35869b4f9329d 100644 --- a/drivers/scsi/ncr53c8xx.c +++ b/drivers/scsi/ncr53c8xx.c @@ -4555,7 +4555,7 @@ static void ncr_detach(struct ncb *np) char inst_name[16]; /* Local copy so we don't access np after freeing it! */ - strlcpy(inst_name, ncr_name(np), sizeof(inst_name)); + strscpy(inst_name, ncr_name(np), sizeof(inst_name)); printk("%s: releasing host resources\n", ncr_name(np));