Messages in this thread Patch in this message | | | From | Artem Chernyshev <> | Subject | [PATCH v3] btrfs: Replace strncpy() with strscpy() | Date | Tue, 22 Nov 2022 17:51:08 +0300 |
| |
Using strncpy() on NUL-terminated strings are deprecated. To avoid possible forming of non-terminated string strscpy() could be used.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 475f63874d73 ("btrfs: new ioctls for scrub") Fixes: 606686eeac45 ("Btrfs: use rcu to protect device->name") Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru> --- V1->V2 Fixed typo in subject V2->V3 Added fix for ioctl.c
fs/btrfs/ioctl.c | 5 ++--- fs/btrfs/rcu-string.h | 5 ++++- 2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index d5dd8bed1488..fdf62d514662 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -3748,9 +3748,8 @@ static long btrfs_ioctl_dev_info(struct btrfs_fs_info *fs_info, di_args->total_bytes = btrfs_device_get_total_bytes(dev); memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid)); if (dev->name) { - strncpy(di_args->path, rcu_str_deref(dev->name), - sizeof(di_args->path) - 1); - di_args->path[sizeof(di_args->path) - 1] = 0; + strscpy(di_args->path, rcu_str_deref(dev->name), + sizeof(di_args->path)); } else { di_args->path[0] = '\0'; } diff --git a/fs/btrfs/rcu-string.h b/fs/btrfs/rcu-string.h index 5c1a617eb25d..d9894da7a05a 100644 --- a/fs/btrfs/rcu-string.h +++ b/fs/btrfs/rcu-string.h @@ -18,7 +18,10 @@ static inline struct rcu_string *rcu_string_strdup(const char *src, gfp_t mask) (len * sizeof(char)), mask); if (!ret) return ret; - strncpy(ret->str, src, len); + if (WARN_ON(strscpy(ret->str, src, len) < 0)) { + kfree(ret); + return NULL; + } return ret; } -- 2.30.3
| |