Commit 37f1663c authored May 16, 2023 by Azeem Shaikh Committed by Martin K. Petersen May 16, 2023

scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()

strlcpy() reads the entire source buffer first.  This read may exceed the
destination size limit.  This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated [1].  In an effort
to remove strlcpy() completely [2], replace strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89



Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
Link: https://lore.kernel.org/r/20230516025404.2843867-1-azeemshaikh38@gmail.com


Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent 41300cc9

drivers/scsi/qla2xxx/qla_init.c

+4 −4

Original line number	Original line	Diff line number	Diff line
	@@ -5076,7 +5076,7 @@ qla2x00_set_model_info(scsi_qla_host_t vha, uint8_t model, size_t len,
	if (use_tbl &&		if (use_tbl &&
	ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&		ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&
	index < QLA_MODEL_NAMES)		index < QLA_MODEL_NAMES)
	strlcpy(ha->model_desc,		strscpy(ha->model_desc,
	qla2x00_model_name[index * 2 + 1],		qla2x00_model_name[index * 2 + 1],
	sizeof(ha->model_desc));		sizeof(ha->model_desc));
	} else {		} else {
	@@ -5084,14 +5084,14 @@ qla2x00_set_model_info(scsi_qla_host_t vha, uint8_t model, size_t len,
	if (use_tbl &&		if (use_tbl &&
	ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&		ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&
	index < QLA_MODEL_NAMES) {		index < QLA_MODEL_NAMES) {
	strlcpy(ha->model_number,		strscpy(ha->model_number,
	qla2x00_model_name[index * 2],		qla2x00_model_name[index * 2],
	sizeof(ha->model_number));		sizeof(ha->model_number));
	strlcpy(ha->model_desc,		strscpy(ha->model_desc,
	qla2x00_model_name[index * 2 + 1],		qla2x00_model_name[index * 2 + 1],
	sizeof(ha->model_desc));		sizeof(ha->model_desc));
	} else {		} else {
	strlcpy(ha->model_number, def,		strscpy(ha->model_number, def,
	sizeof(ha->model_number));		sizeof(ha->model_number));
	}		}
	}		}

drivers/scsi/qla2xxx/qla_mr.c

+10 −10

Original line number	Original line	Diff line number	Diff line
	@@ -691,7 +691,7 @@ qlafx00_pci_info_str(struct scsi_qla_host vha, char str, size_t str_len)
	struct qla_hw_data *ha = vha->hw;		struct qla_hw_data *ha = vha->hw;

	if (pci_is_pcie(ha->pdev))		if (pci_is_pcie(ha->pdev))
	strlcpy(str, "PCIe iSA", str_len);		strscpy(str, "PCIe iSA", str_len);
	return str;		return str;
	}		}

	@@ -1850,21 +1850,21 @@ qlafx00_fx_disc(scsi_qla_host_t vha, fc_port_t fcport, uint16_t fx_type)
	phost_info = &preg_hsi->hsi;		phost_info = &preg_hsi->hsi;
	memset(preg_hsi, 0, sizeof(struct register_host_info));		memset(preg_hsi, 0, sizeof(struct register_host_info));
	phost_info->os_type = OS_TYPE_LINUX;		phost_info->os_type = OS_TYPE_LINUX;
	strlcpy(phost_info->sysname, p_sysid->sysname,		strscpy(phost_info->sysname, p_sysid->sysname,
	sizeof(phost_info->sysname));		sizeof(phost_info->sysname));
	strlcpy(phost_info->nodename, p_sysid->nodename,		strscpy(phost_info->nodename, p_sysid->nodename,
	sizeof(phost_info->nodename));		sizeof(phost_info->nodename));
	if (!strcmp(phost_info->nodename, "(none)"))		if (!strcmp(phost_info->nodename, "(none)"))
	ha->mr.host_info_resend = true;		ha->mr.host_info_resend = true;
	strlcpy(phost_info->release, p_sysid->release,		strscpy(phost_info->release, p_sysid->release,
	sizeof(phost_info->release));		sizeof(phost_info->release));
	strlcpy(phost_info->version, p_sysid->version,		strscpy(phost_info->version, p_sysid->version,
	sizeof(phost_info->version));		sizeof(phost_info->version));
	strlcpy(phost_info->machine, p_sysid->machine,		strscpy(phost_info->machine, p_sysid->machine,
	sizeof(phost_info->machine));		sizeof(phost_info->machine));
	strlcpy(phost_info->domainname, p_sysid->domainname,		strscpy(phost_info->domainname, p_sysid->domainname,
	sizeof(phost_info->domainname));		sizeof(phost_info->domainname));
	strlcpy(phost_info->hostdriver, QLA2XXX_VERSION,		strscpy(phost_info->hostdriver, QLA2XXX_VERSION,
	sizeof(phost_info->hostdriver));		sizeof(phost_info->hostdriver));
	preg_hsi->utc = (uint64_t)ktime_get_real_seconds();		preg_hsi->utc = (uint64_t)ktime_get_real_seconds();
	ql_dbg(ql_dbg_init, vha, 0x0149,		ql_dbg(ql_dbg_init, vha, 0x0149,
	@@ -1909,9 +1909,9 @@ qlafx00_fx_disc(scsi_qla_host_t vha, fc_port_t fcport, uint16_t fx_type)
	if (fx_type == FXDISC_GET_CONFIG_INFO) {		if (fx_type == FXDISC_GET_CONFIG_INFO) {
	struct config_info_data *pinfo =		struct config_info_data *pinfo =
	(struct config_info_data *) fdisc->u.fxiocb.rsp_addr;		(struct config_info_data *) fdisc->u.fxiocb.rsp_addr;
	strlcpy(vha->hw->model_number, pinfo->model_num,		strscpy(vha->hw->model_number, pinfo->model_num,
	ARRAY_SIZE(vha->hw->model_number));		ARRAY_SIZE(vha->hw->model_number));
	strlcpy(vha->hw->model_desc, pinfo->model_description,		strscpy(vha->hw->model_desc, pinfo->model_description,
	ARRAY_SIZE(vha->hw->model_desc));		ARRAY_SIZE(vha->hw->model_desc));
	memcpy(&vha->hw->mr.symbolic_name, pinfo->symbolic_name,		memcpy(&vha->hw->mr.symbolic_name, pinfo->symbolic_name,
	sizeof(vha->hw->mr.symbolic_name));		sizeof(vha->hw->mr.symbolic_name));