usb: typec: tcpm: replace strcpy with strscpy

PATCH In review Maxwell Doose 4 participants 7 messages Apr 19 – May 4

Subsystems (3)

USB USB Type-C class USB Type-C port controller drivers

lore

Share & tools

lore

Maxwell Doose

author

2026-04-19 21:38 UTC #0 lore raw

PATCH 1/1 usb: typec: tcpm: replace strcpy with strscpy

The function strcpy() is deprecated as it can be used in buffer overflow attacks. This patch replaces strcpy() with strscpy() to improve security and stability.

Signed-off-by Maxwell Doose <[email protected]>

---
 drivers/usb/typec/tcpm/tcpm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/usb/typec/tcpm/tcpm.c +3 -3

index 8e0e14a2704e..69574c5e79e1 100644
@@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
 
 	if (tcpm_log_full(port)) {
 		port->logbuffer_head = max(port->logbuffer_head - 1, 0);
-		strcpy(tmpbuffer, "overflow");
+		strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
 	}
 
 	if (port->logbuffer_head < 0 ||

@@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
 					  pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
 					  pdo_spr_avs_apdo_src_peak_current(pdo));
 			else
-				strcpy(msg, "undefined APDO");
+				strscpy(msg, "undefined APDO", sizeof(msg));
 			break;
 		default:
-			strcpy(msg, "undefined");
+			strscpy(msg, "undefined", sizeof(msg));
 			break;
 		}
 		tcpm_log(port, " PDO %d: type %d, %s",

Signature · 1 line

2.53.0

Amit Sunil Dhamne

2026-04-23 19:23 UTC #1 lore raw

Hi Maxwell,

Quoted 25 lines · Maxwell Doose

The function strcpy() is deprecated as it can be used in buffer overflow attacks. This patch replaces strcpy() with strscpy() to improve security and stability.

Signed-off-by Maxwell Doose <[email protected]>

---
  drivers/usb/typec/tcpm/tcpm.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)

drivers/usb/typec/tcpm/tcpm.c +1 -1

index 8e0e14a2704e..69574c5e79e1 100644
@@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
 
  	if (tcpm_log_full(port)) {
  		port->logbuffer_head = max(port->logbuffer_head - 1, 0);
-		strcpy(tmpbuffer, "overflow");
+		strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
  	}
 
  	if (port->logbuffer_head < 0 ||

@@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
  					  pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
  					  pdo_spr_avs_apdo_src_peak_current(pdo));

drivers/usb/typec/tcpm/tcpm.c static void tcpm_log_source_caps(struct tcpm_port *port) · line 850

Quoted 10 lines

drivers/usb/typec/tcpm/tcpm.c +2 -2

  			else
-				strcpy(msg, "undefined APDO");
+				strscpy(msg, "undefined APDO", sizeof(msg));
  			break;
  		default:
-			strcpy(msg, "undefined");
+			strscpy(msg, "undefined", sizeof(msg));
  			break;
  		}
  		tcpm_log(port, " PDO %d: type %d, %s",

This has already been fixed as part of [1].

[1] https://patch.msgid.link/[email protected]

BR,

Amit

Maxwell Doose

author

2026-04-23 20:57 UTC #2 lore raw

Quoted 7 lines · Amit Sunil Dhamne

Hi Maxwell,
This has already been fixed as part of [1].
[1] https://patch.msgid.link/[email protected]

Ah, didn't see that. I'll go focus on other things for now then.

best regards,
maxwell

David Laight

2026-04-29 08:54 UTC #3 lore raw

In reply to Amit Sunil Dhamne

Quoted 24 lines · On Thu, 23 Apr 2026 12:23:09 -0700 Amit Sunil Dhamne <[email protected]> wrote:

Hi Maxwell,
Quoted 21 lines · Maxwell Doose
The function strcpy() is deprecated as it can be used in buffer overflow attacks. This patch replaces strcpy() with strscpy() to improve security and stability.
Signed-off-by Maxwell Doose <[email protected]>
---
  drivers/usb/typec/tcpm/tcpm.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +1 -1
index 8e0e14a2704e..69574c5e79e1 100644
@@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
 
  	if (tcpm_log_full(port)) {
  		port->logbuffer_head = max(port->logbuffer_head - 1, 0);
-		strcpy(tmpbuffer, "overflow");
+		strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
  	}
 

Quoted 16 lines

Quoted 4 lines

drivers/usb/typec/tcpm/tcpm.c +0 -0

  	if (port->logbuffer_head < 0 ||

@@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
  					  pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
  					  pdo_spr_avs_apdo_src_peak_current(pdo));

drivers/usb/typec/tcpm/tcpm.c static void tcpm_log_source_caps(struct tcpm_port *port) · line 850

Quoted 10 lines

drivers/usb/typec/tcpm/tcpm.c +2 -2

  			else
-				strcpy(msg, "undefined APDO");
+				strscpy(msg, "undefined APDO", sizeof(msg));
  			break;
  		default:
-			strcpy(msg, "undefined");
+			strscpy(msg, "undefined", sizeof(msg));
  			break;
  		}
  		tcpm_log(port, " PDO %d: type %d, %s",

This has already been fixed as part of [1].

It is also 'not a fix'.
strcpy() is fine for copying literal strings into arrays.
With the kernel headers you get a compile error from strcpy() if the string is too long.
OTOH strscpy() will truncate overlong strings.

David

Quoted 9 lines

[1] https://patch.msgid.link/[email protected]
BR,
Amit

Amit Sunil Dhamne

2026-05-04 18:09 UTC #4 lore raw

Hi David,

Quoted 42 lines · David Laight

Quoted 24 lines · On Thu, 23 Apr 2026 12:23:09 -0700 Amit Sunil Dhamne <[email protected]> wrote:
Hi Maxwell,
Quoted 21 lines · Maxwell Doose
The function strcpy() is deprecated as it can be used in buffer overflow attacks. This patch replaces strcpy() with strscpy() to improve security and stability.
Signed-off-by Maxwell Doose <[email protected]>
---
  drivers/usb/typec/tcpm/tcpm.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +1 -1
index 8e0e14a2704e..69574c5e79e1 100644
@@ -725,7 +725,7 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
 
  	if (tcpm_log_full(port)) {
  		port->logbuffer_head = max(port->logbuffer_head - 1, 0);
-		strcpy(tmpbuffer, "overflow");
+		strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
  	}
 
Quoted 15 lines
Quoted 4 lines
drivers/usb/typec/tcpm/tcpm.c +0 -0
  	if (port->logbuffer_head < 0 ||
@@ -841,10 +841,10 @@ static void tcpm_log_source_caps(struct tcpm_port *port)
  					  pdo_spr_avs_apdo_15v_to_20v_max_current_ma(pdo),
  					  pdo_spr_avs_apdo_src_peak_current(pdo));
drivers/usb/typec/tcpm/tcpm.c static void tcpm_log_source_caps(struct tcpm_port *port) · line 850
Quoted 10 lines
drivers/usb/typec/tcpm/tcpm.c +2 -2
  			else
-				strcpy(msg, "undefined APDO");
+				strscpy(msg, "undefined APDO", sizeof(msg));
  			break;
  		default:
-			strcpy(msg, "undefined");
+			strscpy(msg, "undefined", sizeof(msg));
  			break;
  		}
  		tcpm_log(port, " PDO %d: type %d, %s",  
This has already been fixed as part of [1].

Quoted 5 lines

It is also 'not a fix'.
strcpy() is fine for copying literal strings into arrays.
With the kernel headers you get a compile error from strcpy() if the string is too long.
OTOH strscpy() will truncate overlong strings.

Thanks for the explanation :) .

Quoted 10 lines

David
Quoted 8 lines
[1] https://patch.msgid.link/[email protected]
BR,
Amit

kernel test robot

build bot

2026-04-27 23:02 UTC #5 lore raw

In reply to Maxwell Doose

kernel test robot noticed the following build errors:

Hi Maxwell,

kernel test robot noticed the following build errors:

[auto build test ERROR on v7.0]
[cannot apply to usb/usb-testing usb/usb-next usb/usb-linus linus/master next-20260427] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Maxwell-Doose/usb-typec-tcpm-replace-strcpy-with-strscpy/20260427-011111
base:   v7.0
patch link:    https://lore.kernel.org/r/20260419213638.38291-2-m32285159%40gmail.com
patch subject: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
config: m68k-allmodconfig (https://download.01.org/0day-ci/archive/20260428/[email protected]/config)
compiler: m68k-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260428/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All errors (new ones prefixed by >>):

drivers/usb/typec/tcpm/tcpm.c: In function '_tcpm_log':

>> drivers/usb/typec/tcpm/tcpm.c:729:9: error: expected ';' before '}' token
     729 |         }
         |         ^

vim +729 drivers/usb/typec/tcpm/tcpm.c

f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  706  
e79e01254d02ff drivers/staging/typec/tcpm.c  Joe Perches   2017-08-25  707  __printf(2, 0)
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  708  static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  709  {
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  710  	char tmpbuffer[LOG_BUFFER_ENTRY_SIZE];
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  711  	u64 ts_nsec = local_clock();
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  712  	unsigned long rem_nsec;
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  713  
d5a4f93511b700 drivers/usb/typec/tcpm.c      Peter Chen    2018-06-12  714  	mutex_lock(&port->logbuffer_lock);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  715  	if (!port->logbuffer[port->logbuffer_head]) {
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  716  		port->logbuffer[port->logbuffer_head] =
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  717  				kzalloc(LOG_BUFFER_ENTRY_SIZE, GFP_KERNEL);
d5a4f93511b700 drivers/usb/typec/tcpm.c      Peter Chen    2018-06-12  718  		if (!port->logbuffer[port->logbuffer_head]) {
d5a4f93511b700 drivers/usb/typec/tcpm.c      Peter Chen    2018-06-12  719  			mutex_unlock(&port->logbuffer_lock);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  720  			return;
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  721  		}
d5a4f93511b700 drivers/usb/typec/tcpm.c      Peter Chen    2018-06-12  722  	}
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  723  
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  724  	vsnprintf(tmpbuffer, sizeof(tmpbuffer), fmt, args);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  725  
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  726  	if (tcpm_log_full(port)) {
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  727  		port->logbuffer_head = max(port->logbuffer_head - 1, 0);
2919950c498311 drivers/usb/typec/tcpm/tcpm.c Maxwell Doose 2026-04-19  728  		strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27 @729  	}
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  730  
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  731  	if (port->logbuffer_head < 0 ||
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  732  	    port->logbuffer_head >= LOG_BUFFER_ENTRIES) {
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  733  		dev_warn(port->dev,
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  734  			 "Bad log buffer index %d\n", port->logbuffer_head);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  735  		goto abort;
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  736  	}
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  737  
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  738  	if (!port->logbuffer[port->logbuffer_head]) {
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  739  		dev_warn(port->dev,
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  740  			 "Log buffer index %d is NULL\n", port->logbuffer_head);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  741  		goto abort;
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  742  	}
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  743  
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  744  	rem_nsec = do_div(ts_nsec, 1000000000);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  745  	scnprintf(port->logbuffer[port->logbuffer_head],
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  746  		  LOG_BUFFER_ENTRY_SIZE, "[%5lu.%06lu] %s",
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  747  		  (unsigned long)ts_nsec, rem_nsec / 1000,
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  748  		  tmpbuffer);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  749  	port->logbuffer_head = (port->logbuffer_head + 1) % LOG_BUFFER_ENTRIES;
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  750  
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  751  abort:
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  752  	mutex_unlock(&port->logbuffer_lock);
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  753  }
f0690a25a140b8 drivers/staging/typec/tcpm.c  Guenter Roeck 2017-04-27  754

Signature · 2 lines

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

kernel test robot

build bot

2026-04-28 23:11 UTC #6 lore raw

In reply to Maxwell Doose

kernel test robot noticed the following build errors:

Hi Maxwell,

kernel test robot noticed the following build errors:

[auto build test ERROR on v7.0]
[cannot apply to usb/usb-testing usb/usb-next usb/usb-linus linus/master next-20260428] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Maxwell-Doose/usb-typec-tcpm-replace-strcpy-with-strscpy/20260427-011111
base:   v7.0
patch link:    https://lore.kernel.org/r/20260419213638.38291-2-m32285159%40gmail.com
patch subject: [PATCH] usb: typec: tcpm: replace strcpy with strscpy
config: riscv-allyesconfig (https://download.01.org/0day-ci/archive/20260429/[email protected]/config)
compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260429/[email protected]/reproduce)

All errors (new ones prefixed by >>):

>> drivers/usb/typec/tcpm/tcpm.c:728:52: error: expected ';' after expression
                   strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
                                                                    ^
                                                                    ;

1 error generated.

vim +728 drivers/usb/typec/tcpm/tcpm.c

706
707 __printf(2, 0)
708 static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
709 {
710 char tmpbuffer[LOG_BUFFER_ENTRY_SIZE];
711 u64 ts_nsec = local_clock();
712 unsigned long rem_nsec;
713
714 mutex_lock(&port->logbuffer_lock);
715 if (!port->logbuffer[port->logbuffer_head]) {
716 port->logbuffer[port->logbuffer_head] =
717 kzalloc(LOG_BUFFER_ENTRY_SIZE, GFP_KERNEL);
718 if (!port->logbuffer[port->logbuffer_head]) {
719 mutex_unlock(&port->logbuffer_lock);
720 return;
721 }
722 }
723
724 vsnprintf(tmpbuffer, sizeof(tmpbuffer), fmt, args);
725
726 if (tcpm_log_full(port)) {
727 port->logbuffer_head = max(port->logbuffer_head - 1, 0);

 > 728			strscpy(tmpbuffer, "overflow", sizeof(tmpbuffer))
   729		}
   730	
   731		if (port->logbuffer_head < 0 ||
   732		    port->logbuffer_head >= LOG_BUFFER_ENTRIES) {
   733			dev_warn(port->dev,
   734				 "Bad log buffer index %d\n", port->logbuffer_head);
   735			goto abort;
   736		}
   737	
   738		if (!port->logbuffer[port->logbuffer_head]) {
   739			dev_warn(port->dev,
   740				 "Log buffer index %d is NULL\n", port->logbuffer_head);
   741			goto abort;
   742		}
   743	
   744		rem_nsec = do_div(ts_nsec, 1000000000);
   745		scnprintf(port->logbuffer[port->logbuffer_head],
   746			  LOG_BUFFER_ENTRY_SIZE, "[%5lu.%06lu] %s",
   747			  (unsigned long)ts_nsec, rem_nsec / 1000,
   748			  tmpbuffer);

749 port->logbuffer_head = (port->logbuffer_head + 1) % LOG_BUFFER_ENTRIES;
750
751 abort:
752 mutex_unlock(&port->logbuffer_lock);
753 }
754

Signature · 2 lines

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki