Skip to content

Commit 5bb288c

Browse files
committed
scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings
The prior strscpy() replacement of strncpy() here expected the manufacture_reply strings to be NUL-terminated, but it is possible they are not, as the code pattern here shows, e.g., edev->vendor_id being exactly 1 character larger than manufacture_reply->vendor_id, and the replaced strncpy() was copying only up to the size of the source character array. Replace this with memtostr(), which is the unambiguous way to convert a maybe not-NUL-terminated character array into a NUL-terminated string. Reported-by: Charles Bertsch <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Fixes: 45e833f ("scsi: message: fusion: Replace deprecated strncpy() with strscpy()") Reviewed-by: Martin K. Petersen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Kees Cook <[email protected]>
1 parent f700b71 commit 5bb288c

File tree

1 file changed

+5
-9
lines changed

1 file changed

+5
-9
lines changed

drivers/message/fusion/mptsas.c

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2964,17 +2964,13 @@ mptsas_exp_repmanufacture_info(MPT_ADAPTER *ioc,
29642964
goto out_free;
29652965

29662966
manufacture_reply = data_out + sizeof(struct rep_manu_request);
2967-
strscpy(edev->vendor_id, manufacture_reply->vendor_id,
2968-
sizeof(edev->vendor_id));
2969-
strscpy(edev->product_id, manufacture_reply->product_id,
2970-
sizeof(edev->product_id));
2971-
strscpy(edev->product_rev, manufacture_reply->product_rev,
2972-
sizeof(edev->product_rev));
2967+
memtostr(edev->vendor_id, manufacture_reply->vendor_id);
2968+
memtostr(edev->product_id, manufacture_reply->product_id);
2969+
memtostr(edev->product_rev, manufacture_reply->product_rev);
29732970
edev->level = manufacture_reply->sas_format;
29742971
if (manufacture_reply->sas_format) {
2975-
strscpy(edev->component_vendor_id,
2976-
manufacture_reply->component_vendor_id,
2977-
sizeof(edev->component_vendor_id));
2972+
memtostr(edev->component_vendor_id,
2973+
manufacture_reply->component_vendor_id);
29782974
tmp = (u8 *)&manufacture_reply->component_id;
29792975
edev->component_id = tmp[0] << 8 | tmp[1];
29802976
edev->component_revision_id =

0 commit comments

Comments
 (0)