net/ipv4: Replace tcp_ca_get_name_by_key()'s strncpy() with strscpy()
Subsystems (3)
PATCH 1/1 net/ipv4: Replace tcp_ca_get_name_by_key()'s strncpy() with strscpy()
Replace the deprecated[1] use of strncpy() in tcp_ca_get_name_by_key(). The only caller passes the results to nla_put_string(), so trailing padding is not needed.
Since passing "buffer" decays it to a pointer, the size can't be trivially determined by the compiler. ca->name is the same length, so strscpy() won't fail (when ca->name is NUL-terminated). Include the length explicitly instead of using the 2-argument strscpy().
---
Cc: Eric Dumazet <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: David Ahern <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: [email protected]
--- net/ipv4/tcp_cong.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv4/tcp_cong.c +4 -3
@@ -203,9 +203,10 @@ char *tcp_ca_get_name_by_key(u32 key, char *buffer)rcu_read_lock (); ca =tcp_ca_find_key (key); -if (ca) - ret =strncpy (buffer, ca->name, -TCP_CA_NAME_MAX ); +if (ca) { +strscpy (buffer, ca->name,TCP_CA_NAME_MAX ); + ret = buffer; + }rcu_read_unlock ();return ret;
Signature · 1 line
2.34.1
Quoted 30 lines · Kees Cook
Replace the deprecated[1] use of
strncpy()intcp_ca_get_name_by_key(). The only caller passes the results tonla_put_string(), so trailing padding is not needed.Since passing "buffer" decays it to a pointer, the size can't be trivially determined by the compiler.
ca->nameis the same length, sostrscpy()won't fail (whenca->nameis NUL-terminated). Include the length explicitly instead of using the 2-argumentstrscpy().Signed-off-by Kees Cook <[email protected]>---
Cc: Eric Dumazet <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: David Ahern <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: [email protected]--- net/ipv4/tcp_cong.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)net/ipv4/tcp_cong.c +0
-0@@ -203,9 +203,10 @@ char *tcp_ca_get_name_by_key(u32 key, char *buffer)rcu_read_lock ();
net/ipv4/tcp_cong.c char *tcp_ca_get_name_by_key(u32 key, char *buffer) · line 211
Quoted 10 lines
net/ipv4/tcp_cong.c +4
-3ca =tcp_ca_find_key (key); -if (ca) - ret =strncpy (buffer, ca->name, -TCP_CA_NAME_MAX ); +if (ca) { +strscpy (buffer, ca->name,TCP_CA_NAME_MAX ); + ret = buffer; + }rcu_read_unlock ();
Ok, but what about tcp_get_default_congestion_control() ?
Thanks.
Quoted 30 lines · Eric Dumazet
Quoted 29 lines · Kees Cook
Replace the deprecated[1] use of
strncpy()intcp_ca_get_name_by_key(). The only caller passes the results tonla_put_string(), so trailing padding is not needed.Since passing "buffer" decays it to a pointer, the size can't be trivially determined by the compiler.
ca->nameis the same length, sostrscpy()won't fail (whenca->nameis NUL-terminated). Include the length explicitly instead of using the 2-argumentstrscpy().Signed-off-by Kees Cook <[email protected]>---
Cc: Eric Dumazet <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: David Ahern <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: [email protected]--- net/ipv4/tcp_cong.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)net/ipv4/tcp_cong.c +0
-0@@ -203,9 +203,10 @@ char *tcp_ca_get_name_by_key(u32 key, char *buffer)
Quoted 13 lines
net/ipv4/tcp_cong.c char *tcp_ca_get_name_by_key(u32 key, char *buffer) · line 211
Quoted 11 lines
net/ipv4/tcp_cong.c +4
-3rcu_read_lock (); ca =tcp_ca_find_key (key); -if (ca) - ret =strncpy (buffer, ca->name, -TCP_CA_NAME_MAX ); +if (ca) { +strscpy (buffer, ca->name,TCP_CA_NAME_MAX ); + ret = buffer; + }rcu_read_unlock ();Ok, but what about
tcp_get_default_congestion_control()?
Whoops. Yes. I'll do that at the same time. v2 coming...
Signature · 1 line
Kees Cook