lkml.org 
[lkml]   [2023]   [Oct]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH] power: supply: bq24190_charger: replace deprecated strncpy with strscpy
    From
    strncpy() is deprecated for use on NUL-terminated destination strings
    [1] and as such we should prefer more robust and less ambiguous string
    interfaces.

    We expect bdi->model_name to be NUL-terminated based on its usage with
    sysfs_emit and format strings:

    val->strval is assigned to bdi->model_name in
    bq24190_charger_get_property():
    1186 | val->strval = bdi->model_name;

    ... then in power_supply_sysfs.c we use value.strval with a format string:
    311 | ret = sysfs_emit(buf, "%s\n", value.strval);

    we assigned value.strval via:
    285 | ret = power_supply_get_property(psy, psp, &value);
    ... which invokes psy->desc->get_property():
    1210 | return psy->desc->get_property(psy, psp, val);

    with bq24190_charger_get_property():
    1320 | static const struct power_supply_desc bq24190_charger_desc = {
    ...
    1325 | .get_property = bq24190_charger_get_property,

    Moreover, no NUL-padding is required as bdi is zero-allocated in
    bq24190_charger.c:
    1798 | bdi = devm_kzalloc(dev, sizeof(*bdi), GFP_KERNEL);

    Considering the above, a suitable replacement is `strscpy` [2] due to
    the fact that it guarantees NUL-termination on the destination buffer
    without unnecessarily NUL-padding.

    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
    Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2]
    Link: https://github.com/KSPP/linux/issues/90
    Cc: linux-hardening@vger.kernel.org
    Signed-off-by: Justin Stitt <justinstitt@google.com>
    ---
    Note: build-tested only.

    Found with: $ rg "strncpy\("
    ---
    drivers/power/supply/bq24190_charger.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
    index 3f99cb9590ba..1db290ee2591 100644
    --- a/drivers/power/supply/bq24190_charger.c
    +++ b/drivers/power/supply/bq24190_charger.c
    @@ -1803,7 +1803,7 @@ static int bq24190_probe(struct i2c_client *client)

    bdi->client = client;
    bdi->dev = dev;
    - strncpy(bdi->model_name, id->name, I2C_NAME_SIZE);
    + strscpy(bdi->model_name, id->name, sizeof(bdi->model_name));
    mutex_init(&bdi->f_reg_lock);
    bdi->charge_type = POWER_SUPPLY_CHARGE_TYPE_FAST;
    bdi->f_reg = 0;
    ---
    base-commit: bb55d7f7f7445abcc8db50e6a65d4315e79f75c7
    change-id: 20231020-strncpy-drivers-power-supply-bq24190_charger-c-6bcc105fc23b
    Best regards,
    --
    Justin Stitt <justinstitt@google.com>

    \
     
     \ /
      Last update: 2023-10-20 20:15    [W:3.489 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site