Skip to contentSkip to conversation

scsi: ibmvscsis: Fix a stringop-overflow warning

PATCH Superseded Laura Abbott 2 participants 3 messages Sep 11, 2018

Subsystems (2)
SCSI IBM Power Virtual SCSI Device Target Driver

v2 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Laura Abbott

author
#0 lore raw

PATCH v2 1/1 scsi: ibmvscsis: Fix a stringop-overflow warning

There's currently a warning about string overflow with strncat:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified bound 64 equals destination size [-Werror=stringop-overflow=]
strncat(vscsi->eye, vdev->name, MAX_EYE); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Switch to a single snprintf instead of a strcpy + strcat to handle this cleanly.

Signed-off-by Laura Abbott <[email protected]>

---
v2: Swtich to using snprintf per suggestion of Kees

---
 drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +1 -2
index fac377320158..9305440a00a1 100644
@@ -3474,8 +3474,7 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
 		vscsi->dds.window[LOCAL].liobn,
 		vscsi->dds.window[REMOTE].liobn);
 
-	strcpy(vscsi->eye, "VSCSI ");
-	strncat(vscsi->eye, vdev->name, MAX_EYE);
+	snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI%s", vdev->name);
 
 	vscsi->dds.unit_id = vdev->unit_address;
 	strncpy(vscsi->dds.partition_name, partition_name,
Signature · 1 line
2.17.1
Reviewed-by on v2 1/1
#1 lore raw
Quoted 9 lines · Laura Abbott

There's currently a warning about string overflow with strncat:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified bound 64 equals destination size [-Werror=stringop-overflow=]
strncat(vscsi->eye, vdev->name, MAX_EYE); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Quoted 4 lines

Switch to a single snprintf instead of a strcpy + strcat to handle this cleanly.

Signed-off-by Laura Abbott <[email protected]>
Reviewed-by Kees Cook <[email protected]>

-Kees

Quoted 23 lines

---
v2: Swtich to using snprintf per suggestion of Kees

---
 drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +1 -3
index fac377320158..9305440a00a1 100644
@@ -3474,8 +3474,7 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
                vscsi->dds.window[LOCAL].liobn,
                vscsi->dds.window[REMOTE].liobn);
 
-       strcpy(vscsi->eye, "VSCSI ");
-       strncat(vscsi->eye, vdev->name, MAX_EYE);
+       snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI%s", vdev->name);
 
        vscsi->dds.unit_id = vdev->unit_address;
        strncpy(vscsi->dds.partition_name, partition_name,
--

2.17.1

Signature · 2 lines
Kees Cook
Pixel Security
#2 lore raw
Quoted 33 lines · Kees Cook
Quoted 9 lines · Laura Abbott

There's currently a warning about string overflow with strncat:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified bound 64 equals destination size [-Werror=stringop-overflow=]
strncat(vscsi->eye, vdev->name, MAX_EYE); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Quoted 4 lines

Switch to a single snprintf instead of a strcpy + strcat to handle this cleanly.

Signed-off-by Laura Abbott <[email protected]>
Reviewed-by Kees Cook <[email protected]>

-Kees

Quoted 14 lines

---
v2: Swtich to using snprintf per suggestion of Kees

---
 drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +0 -0
index fac377320158..9305440a00a1 100644
@@ -3474,8 +3474,7 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
                vscsi->dds.window[LOCAL].liobn,
                vscsi->dds.window[REMOTE].liobn);
Quoted 3 lines

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c static int ibmvscsis_probe(struct vio_dev *vdev, · line 3477

Quoted 3 lines
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +1 -2
-       strcpy(vscsi->eye, "VSCSI ");
-       strncat(vscsi->eye, vdev->name, MAX_EYE);
+       snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI%s", vdev->name);

Eek. No, I take it back: Nick Desaulniers has better eyes than me and pointed out that there should be a space after VSCSI.

-Kees

Quoted 12 lines
Quoted 6 lines
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +0 -1
        vscsi->dds.unit_id = vdev->unit_address;
        strncpy(vscsi->dds.partition_name, partition_name,
--

2.17.1

--
Kees Cook
Pixel Security

Signature · 2 lines
Kees Cook
Pixel Security