[PATCH] scsi: scsi_devinfo: handle non-terminated strings

[PATCH] scsi: scsi_devinfo: handle non-terminated strings

[Martin Wilck]

devinfo->vendor and devinfo->model aren't necessarily
zero-terminated.

Fixes: b8018b973c7c "scsi_devinfo: fixup string compare"
Signed-off-by: Martin Wilck <mwilck@suse.com>
---
 drivers/scsi/scsi_devinfo.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index fe5a9ea27b5e..d6db5697472e 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -458,7 +458,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
 			/*
 			 * vendor strings must be an exact match
 			 */
-			if (vmax != strlen(devinfo->vendor) ||
+			if (vmax != strnlen(devinfo->vendor,
+					    sizeof(devinfo->vendor)) ||
 			    memcmp(devinfo->vendor, vskip, vmax))
 				continue;
 
@@ -466,7 +467,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
 			 * @model specifies the full string, and
 			 * must be larger or equal to devinfo->model
 			 */
-			mlen = strlen(devinfo->model);
+			mlen = strnlen(devinfo->model, sizeof(devinfo->model));
 			if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
 				continue;
 			return devinfo;
-- 
2.15.0

[PATCH] scsi_devinfo: cleanly zero-pad devinfo strings

[Martin Wilck]

Cleanly fill memory for "vendor" and "model" with 0-bytes for
the "compatible" case rather than adding only a single 0 byte.
This simplifies the devinfo code a a bit, and avoids mistakes
in other places of the code (not in current upstream, but we
had one such mistake in the SUSE kernel).

Signed-off-by: Martin Wilck <mwilck@suse.com>
---
 drivers/scsi/scsi_devinfo.c | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index d6db5697472e..6e784a09b21a 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -34,7 +34,6 @@ struct scsi_dev_info_list_table {
 };
 
 
-static const char spaces[] = "                "; /* 16 of them */
 static unsigned scsi_default_dev_flags;
 static LIST_HEAD(scsi_dev_info_list);
 static char scsi_dev_flags[256];
@@ -298,21 +297,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length,
 	size_t from_length;
 
 	from_length = strlen(from);
-	strncpy(to, from, min(to_length, from_length));
-	if (from_length < to_length) {
-		if (compatible) {
-			/*
-			 * NUL terminate the string if it is short.
-			 */
-			to[from_length] = '\0';
-		} else {
-			/*
-			 * space pad the string if it is short.
-			 */
-			strncpy(&to[from_length], spaces,
-				to_length - from_length);
-		}
-	}
+	/* This zero-pads the destination */
+	strncpy(to, from, to_length);
+	if (from_length < to_length && !compatible)
+		/*
+		 * space pad the string if it is short.
+		 */
+		memset(&to[from_length], ' ', to_length - from_length);
 	if (from_length > to_length)
 		 printk(KERN_WARNING "%s: %s string '%s' is too long\n",
 			__func__, name, from);
-- 
2.15.0

Re: [PATCH] scsi_devinfo: cleanly zero-pad devinfo strings

[Bart Van Assche]

On Mon, 2017-11-27 at 23:47 +0100, Martin Wilck wrote:
> +	/* This zero-pads the destination */
> +	strncpy(to, from, to_length);
> +	if (from_length < to_length && !compatible)
> +		/*
> +		 * space pad the string if it is short.
> +		 */
> +		memset(&to[from_length], ' ', to_length - from_length);

Since the code block controlled by the if-statement consists of multiple
lines, shouldn't that block be surrounded by braces ({})? Anyway:

Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>

Re: [PATCH] scsi: scsi_devinfo: handle non-terminated strings

[Bart Van Assche]

On Mon, 2017-11-27 at 23:47 +0100, Martin Wilck wrote:
> devinfo->vendor and devinfo->model aren't necessarily
> zero-terminated.

Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>

Re: [PATCH] scsi: scsi_devinfo: handle non-terminated strings

[Martin K. Petersen]

Martin,

> devinfo->vendor and devinfo->model aren't necessarily
> zero-terminated.

Applied to 4.15/scsi-fixes. Thank you!

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [PATCH] scsi_devinfo: cleanly zero-pad devinfo strings

[Martin K. Petersen]

Martin,

> Cleanly fill memory for "vendor" and "model" with 0-bytes for the
> "compatible" case rather than adding only a single 0 byte.  This
> simplifies the devinfo code a a bit, and avoids mistakes in other
> places of the code (not in current upstream, but we had one such
> mistake in the SUSE kernel).

Applied to 4.15/scsi-fixes. Thank you!

-- 
Martin K. Petersen	Oracle Linux Engineering