linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>,
	Steven French <Steven.French@microsoft.com>,
	Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 3.18 05/13] fs/cifs: suppress a string overflow warning
Date: Mon, 1 Oct 2018 00:41:46 +0000	[thread overview]
Message-ID: <20181001004139.147341-5-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001004139.147341-1-alexander.levin@microsoft.com>

From: Stephen Rothwell <sfr@canb.auug.org.au>

[ Upstream commit bcfb84a996f6fa90b5e6e2954b2accb7a4711097 ]

A powerpc build of cifs with gcc v8.2.0 produces this warning:

fs/cifs/cifssmb.c: In function ‘CIFSSMBNegotiate’:
fs/cifs/cifssmb.c:605:3: warning: ‘strncpy’ writing 16 bytes into a region of size 1 overflows the destination [-Wstringop-overflow=]
   strncpy(pSMB->DialectsArray+count, protocols[i].name, 16);
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Since we are already doing a strlen() on the source, change the strncpy
to a memcpy().

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 fs/cifs/cifssmb.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 949deb938dc9..db72c5284d13 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -577,10 +577,15 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
 	}
 
 	count = 0;
+	/*
+	 * We know that all the name entries in the protocols array
+	 * are short (< 16 bytes anyway) and are NUL terminated.
+	 */
 	for (i = 0; i < CIFS_NUM_PROT; i++) {
-		strncpy(pSMB->DialectsArray+count, protocols[i].name, 16);
-		count += strlen(protocols[i].name) + 1;
-		/* null at end of source and target buffers anyway */
+		size_t len = strlen(protocols[i].name) + 1;
+
+		memcpy(pSMB->DialectsArray+count, protocols[i].name, len);
+		count += len;
 	}
 	inc_rfc1001_len(pSMB, count);
 	pSMB->ByteCount = cpu_to_le16(count);
-- 
2.17.1

  parent reply	other threads:[~2018-10-01  0:42 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-01  0:41 [PATCH AUTOSEL 3.18 01/13] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 02/13] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 03/13] RDMA/ucma: check fd type in ucma_migrate_id() Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 04/13] USB: yurex: Check for truncation in yurex_read() Sasha Levin
2018-10-01  0:41 ` Sasha Levin [this message]
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 06/13] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 07/13] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 08/13] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 09/13] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 10/13] s390/qeth: don't dump past end of unknown HW header Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 11/13] cifs: read overflow in is_valid_oplock_break() Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 12/13] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01  0:41 ` [PATCH AUTOSEL 3.18 13/13] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181001004139.147341-5-alexander.levin@microsoft.com \
    --to=alexander.levin@microsoft.com \
    --cc=Steven.French@microsoft.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sfr@canb.auug.org.au \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).