Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name

The code pattern of memcpy(dst, src, strlen(src)) is almost always wrong. In this case it is wrong because it leaves memory uninitialized if it is less than sizeof(ni->name), and overflows ni->name when longer.

Normally strtomem_pad() could be used here, but since ni->name is a trailing array in struct hci_mon_new_index, compilers that don't support -fstrict-flex-arrays=3 can't tell how large this array is via __builtin_object_size(). Instead, open-code the helper and use sizeof() since it will work correctly.

Additionally mark ni->name as __nonstring since it appears to not be a %NUL terminated C string.

---
 include/net/bluetooth/hci_mon.h | 2 +-
 net/bluetooth/hci_sock.c        | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

index 2d5fcda1bcd0..082f89531b88 100644
@@ -56,7 +56,7 @@ struct hci_mon_new_index {
 	__u8		type;
 	__u8		bus;
 	bdaddr_t	bdaddr;
-	char		name[8];
+	char		name[8] __nonstring;
 } __packed;
 #define HCI_MON_NEW_INDEX_SIZE 16
 

index 72abe54c45dd..3e7cd330d731 100644
@@ -488,7 +488,8 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 		ni->type = hdev->dev_type;
 		ni->bus = hdev->bus;
 		bacpy(&ni->bdaddr, &hdev->bdaddr);
-		memcpy(ni->name, hdev->name, strlen(hdev->name));
+		memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
+			       strnlen(hdev->name, sizeof(ni->name)), '\0');
 
 		opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 		break;

2.34.1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=792247

---Test result---

Test Summary:

CheckPatch                    PASS      0.82 seconds
GitLint                       PASS      1.86 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      41.40 seconds
CheckAllWarning               PASS      45.62 seconds
CheckSparse                   PASS      51.89 seconds
CheckSmatch                   PASS      136.78 seconds
BuildKernel32                 PASS      39.60 seconds
TestRunnerSetup               PASS      611.26 seconds
TestRunner_l2cap-tester       PASS      36.60 seconds
TestRunner_iso-tester         PASS      64.47 seconds
TestRunner_bnep-tester        PASS      12.89 seconds
TestRunner_mgmt-tester        PASS      258.17 seconds
TestRunner_rfcomm-tester      PASS      19.17 seconds
TestRunner_sco-tester         PASS      22.53 seconds
TestRunner_ioctl-tester       PASS      22.02 seconds
TestRunner_mesh-tester        PASS      15.88 seconds
TestRunner_smp-tester         PASS      17.19 seconds
TestRunner_userchan-tester    PASS      14.01 seconds
IncrementalBuild              PASS      37.07 seconds

---
Regards,
Linux Bluetooth