Replace the deprecated[1] strncpy() with strscpy() in transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(), transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().
All four functions follow the same pattern: a local buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated via sprintf()/snprintf() (always NUL-terminated), then conditionally copied to p_buf with strncpy(). The p_buf destination is used as a C string by all callers in target_core_configfs.c: strlen(buf) and sprintf(page+len, "%s", buf) to build sysfs output. NUL-padding is not required: callers in target_core_configfs.c pre-zero p_buf with memset() or initializer before calling these functions, and consume p_buf only as a NUL-terminated C string via strlen() and "%s", never exposing trailing bytes. No behavioral change: the source buf is always NUL-terminated and shorter than VPD_TMP_BUF_SIZE, so strscpy() produces identical output. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <[email protected]> --- drivers/target/target_core_transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index a7330c4fedde..a1b8f581185e 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1112,7 +1112,7 @@ void transport_dump_vpd_proto_id( } if (p_buf) - strncpy(p_buf, buf, p_buf_len); + strscpy(p_buf, buf, p_buf_len); else pr_debug("%s", buf); } @@ -1162,7 +1162,7 @@ int transport_dump_vpd_assoc( } if (p_buf) - strncpy(p_buf, buf, p_buf_len); + strscpy(p_buf, buf, p_buf_len); else pr_debug("%s", buf); @@ -1222,7 +1222,7 @@ int transport_dump_vpd_ident_type( if (p_buf) { if (p_buf_len < strlen(buf)+1) return -EINVAL; - strncpy(p_buf, buf, p_buf_len); + strscpy(p_buf, buf, p_buf_len); } else { pr_debug("%s", buf); } @@ -1276,7 +1276,7 @@ int transport_dump_vpd_ident( } if (p_buf) - strncpy(p_buf, buf, p_buf_len); + strscpy(p_buf, buf, p_buf_len); else pr_debug("%s", buf); -- 2.34.1
