* [PATCHv2] scsi: ibmvscsis: Fix a stringop-overflow warning
@ 2018-09-11 18:05 Laura Abbott
2018-09-11 18:24 ` Kees Cook
0 siblings, 1 reply; 3+ messages in thread
From: Laura Abbott @ 2018-09-11 18:05 UTC (permalink / raw)
To: Bryant G. Ly, Michael Cyr
Cc: Laura Abbott, James E.J. Bottomley, Martin K. Petersen,
linux-scsi, target-devel, linux-kernel, Kees Cook,
Prarit Bhargava
There's currently a warning about string overflow with strncat:
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified
bound 64 equals destination size [-Werror=stringop-overflow=]
strncat(vscsi->eye, vdev->name, MAX_EYE);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Switch to a single snprintf instead of a strcpy + strcat to handle this
cleanly.
Signed-off-by: Laura Abbott <labbott@redhat.com>
---
v2: Swtich to using snprintf per suggestion of Kees
---
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index fac377320158..9305440a00a1 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3474,8 +3474,7 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
vscsi->dds.window[LOCAL].liobn,
vscsi->dds.window[REMOTE].liobn);
- strcpy(vscsi->eye, "VSCSI ");
- strncat(vscsi->eye, vdev->name, MAX_EYE);
+ snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI%s", vdev->name);
vscsi->dds.unit_id = vdev->unit_address;
strncpy(vscsi->dds.partition_name, partition_name,
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCHv2] scsi: ibmvscsis: Fix a stringop-overflow warning
2018-09-11 18:05 [PATCHv2] scsi: ibmvscsis: Fix a stringop-overflow warning Laura Abbott
@ 2018-09-11 18:24 ` Kees Cook
2018-09-11 18:27 ` Kees Cook
0 siblings, 1 reply; 3+ messages in thread
From: Kees Cook @ 2018-09-11 18:24 UTC (permalink / raw)
To: Laura Abbott
Cc: Bryant G. Ly, Michael Cyr, James E.J. Bottomley,
Martin K. Petersen, linux-scsi, target-devel, LKML,
Prarit Bhargava
On Tue, Sep 11, 2018 at 11:05 AM, Laura Abbott <labbott@redhat.com> wrote:
>
> There's currently a warning about string overflow with strncat:
>
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified
> bound 64 equals destination size [-Werror=stringop-overflow=]
> strncat(vscsi->eye, vdev->name, MAX_EYE);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Switch to a single snprintf instead of a strcpy + strcat to handle this
> cleanly.
>
> Signed-off-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
> ---
> v2: Swtich to using snprintf per suggestion of Kees
> ---
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> index fac377320158..9305440a00a1 100644
> --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> @@ -3474,8 +3474,7 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
> vscsi->dds.window[LOCAL].liobn,
> vscsi->dds.window[REMOTE].liobn);
>
> - strcpy(vscsi->eye, "VSCSI ");
> - strncat(vscsi->eye, vdev->name, MAX_EYE);
> + snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI%s", vdev->name);
>
> vscsi->dds.unit_id = vdev->unit_address;
> strncpy(vscsi->dds.partition_name, partition_name,
> --
> 2.17.1
>
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCHv2] scsi: ibmvscsis: Fix a stringop-overflow warning
2018-09-11 18:24 ` Kees Cook
@ 2018-09-11 18:27 ` Kees Cook
0 siblings, 0 replies; 3+ messages in thread
From: Kees Cook @ 2018-09-11 18:27 UTC (permalink / raw)
To: Laura Abbott
Cc: Bryant G. Ly, Michael Cyr, James E.J. Bottomley,
Martin K. Petersen, linux-scsi, target-devel, LKML,
Prarit Bhargava
On Tue, Sep 11, 2018 at 11:24 AM, Kees Cook <keescook@chromium.org> wrote:
> On Tue, Sep 11, 2018 at 11:05 AM, Laura Abbott <labbott@redhat.com> wrote:
>>
>> There's currently a warning about string overflow with strncat:
>>
>> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
>> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified
>> bound 64 equals destination size [-Werror=stringop-overflow=]
>> strncat(vscsi->eye, vdev->name, MAX_EYE);
>> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>
>> Switch to a single snprintf instead of a strcpy + strcat to handle this
>> cleanly.
>>
>> Signed-off-by: Laura Abbott <labbott@redhat.com>
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>
> -Kees
>
>> ---
>> v2: Swtich to using snprintf per suggestion of Kees
>> ---
>> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +--
>> 1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
>> index fac377320158..9305440a00a1 100644
>> --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
>> +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
>> @@ -3474,8 +3474,7 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
>> vscsi->dds.window[LOCAL].liobn,
>> vscsi->dds.window[REMOTE].liobn);
>>
>> - strcpy(vscsi->eye, "VSCSI ");
>> - strncat(vscsi->eye, vdev->name, MAX_EYE);
>> + snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI%s", vdev->name);
Eek. No, I take it back: Nick Desaulniers has better eyes than me and
pointed out that there should be a space after VSCSI.
-Kees
>>
>> vscsi->dds.unit_id = vdev->unit_address;
>> strncpy(vscsi->dds.partition_name, partition_name,
>> --
>> 2.17.1
>>
>
>
>
> --
> Kees Cook
> Pixel Security
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-09-11 18:28 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-11 18:05 [PATCHv2] scsi: ibmvscsis: Fix a stringop-overflow warning Laura Abbott
2018-09-11 18:24 ` Kees Cook
2018-09-11 18:27 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).