linux/drivers/scsi/qla4xxx
Justin Stitt 4f94864d21 scsi: qla4xxx: Replace deprecated strncpy() with strscpy()
Replace 3 instances of strncpy in ql4_mbx.c

No bugs exist in the current implementation as some care was taken to
ensure the write length was decreased by one to leave some space for a
NUL-byte. However, instead of using strncpy(dest, src, LEN-1) we can opt
for strscpy(dest, src, sizeof(dest)) which will result in NUL-termination
as well. It should be noted that the entire chap_table is zero-allocated so
the NUL-padding provided by strncpy is not needed.

While here, I noticed that MIN_CHAP_SECRET_LEN was not used anywhere.
Since strscpy gives us the number of bytes copied into the destination
buffer (or an -E2BIG) we can check both for an error during copying and
also for a non-length compliant secret. Add a new jump label so we can
properly clean up our chap_table should we have to abort due to bad secret.

The third instance in this file involves some more peculiar handling of
strings:
|	uint32_t mbox_cmd[MBOX_REG_COUNT];
|	...
|	memset(&mbox_cmd, 0, sizeof(mbox_cmd));
|	...
|	mbox_cmd[0] = MBOX_CMD_SET_PARAM;
|	if (param == SET_DRVR_VERSION) {
|		mbox_cmd[1] = SET_DRVR_VERSION;
|		strncpy((char *)&mbox_cmd[2], QLA4XXX_DRIVER_VERSION,
|			MAX_DRVR_VER_LEN - 1);

mbox_cmd has a size of 8:
|	#define MBOX_REG_COUNT 8
... and its type width is 4 bytes. Hence, we have 32 bytes to work with
here. The first 4 bytes are used as a flag for the MBOX_CMD_SET_PARAM.
The next 4 bytes are used for SET_DRVR_VERSION. We now have 32-8=24
bytes remaining -- which thankfully is what MAX_DRVR_VER_LEN is equal to
|	#define MAX_DRVR_VER_LEN                    24

... and the thing we're copying into this pseudo-string buffer is
|	#define QLA4XXX_DRIVER_VERSION        "5.04.00-k6"

... which is great because its less than 24 bytes (therefore we aren't
truncating the source).

All to say, there's no bug in the existing implementation (yay!) but we
can clean the code up a bit by using strscpy().

In ql4_os.c, there aren't any strncpy() uses to replace but there are
some existing strscpy() calls that could be made more idiomatic. Where
possible, use strscpy(dest, src, sizeof(dest)). Note that
chap_rec->password has a size of ISCSI_CHAP_AUTH_SECRET_MAX_LEN
|	#define ISCSI_CHAP_AUTH_SECRET_MAX_LEN	256
... while the current strscpy usage uses QL4_CHAP_MAX_SECRET_LEN
|	#define QL4_CHAP_MAX_SECRET_LEN 100
... however since chap_table->secret was set and bounded properly in its
string assignment its probably safe here to switch over to sizeof().

|	struct iscsi_chap_rec {
	...
|		char username[ISCSI_CHAP_AUTH_NAME_MAX_LEN];
|		uint8_t password[ISCSI_CHAP_AUTH_SECRET_MAX_LEN];
	...
|	};

|	strscpy(chap_rec->password, chap_table->secret,
|		QL4_CHAP_MAX_SECRET_LEN);

Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20240305-strncpy-drivers-scsi-mpi3mr-mpi3mr_fw-c-v3-4-5b78a13ff984@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-03-10 18:37:43 -04:00
..
Kconfig
Makefile
ql4_83xx.c scsi: qla4xxx: Simplify conditional 2021-05-10 13:25:12 -04:00
ql4_83xx.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_attr.c scsi: qla4xxx: Switch to attribute groups 2021-10-16 21:45:59 -04:00
ql4_bsg.c scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_bsg.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_dbg.c scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_dbg.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_def.h scsi: qla4xxx: Drop redundant pci_enable_pcie_error_reporting() 2023-03-09 22:00:39 -05:00
ql4_fw.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00
ql4_glbl.h scsi: qla4xxx: Switch to attribute groups 2021-10-16 21:45:59 -04:00
ql4_init.c scsi: qla4xxx: Convert uses of __constant_cpu_to_<foo> to cpu_to_<foo> 2021-08-01 13:39:17 -04:00
ql4_inline.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_iocb.c scsi: qla4xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request 2021-08-11 22:25:41 -04:00
ql4_isr.c scsi: qla4xxx: Remove unused 'count' variable 2023-04-02 21:48:46 -04:00
ql4_mbx.c scsi: qla4xxx: Replace deprecated strncpy() with strscpy() 2024-03-10 18:37:43 -04:00
ql4_nvram.c scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_nvram.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_nx.c scsi: qla4xxx: Convert uses of __constant_cpu_to_<foo> to cpu_to_<foo> 2021-08-01 13:39:17 -04:00
ql4_nx.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00
ql4_os.c scsi: qla4xxx: Replace deprecated strncpy() with strscpy() 2024-03-10 18:37:43 -04:00
ql4_version.h scsi/qla4xxx: Convert to SPDX license identifiers 2020-09-16 14:31:36 +02:00