From d1e8a9fbb39292e6666192565b51bbda781f9f04 Mon Sep 17 00:00:00 2001 From: Azeem Shaikh Date: Wed, 21 Jun 2023 03:00:32 +0000 Subject: scsi: ncr53c8xx: Replace strlcpy() with strscpy() strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Link: https://lore.kernel.org/r/20230621030033.3800351-2-azeemshaikh38@gmail.com Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen --- drivers/scsi/ncr53c8xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/scsi') diff --git a/drivers/scsi/ncr53c8xx.c b/drivers/scsi/ncr53c8xx.c index 4458449c960b..35869b4f9329 100644 --- a/drivers/scsi/ncr53c8xx.c +++ b/drivers/scsi/ncr53c8xx.c @@ -4555,7 +4555,7 @@ static void ncr_detach(struct ncb *np) char inst_name[16]; /* Local copy so we don't access np after freeing it! */ - strlcpy(inst_name, ncr_name(np), sizeof(inst_name)); + strscpy(inst_name, ncr_name(np), sizeof(inst_name)); printk("%s: releasing host resources\n", ncr_name(np)); -- cgit v1.2.3