From: Kees Cook <keescook@chromium.org>
To: "Martin K . Petersen" <martin.petersen@oracle.com>
Cc: Kees Cook <keescook@chromium.org>,
Charles Bertsch <cbertsch@cox.net>,
Justin Stitt <justinstitt@google.com>,
Bart Van Assche <bvanassche@acm.org>,
Andy Shevchenko <andy@kernel.org>,
Sathya Prakash <sathya.prakash@broadcom.com>,
Sreekanth Reddy <sreekanth.reddy@broadcom.com>,
Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
Kashyap Desai <kashyap.desai@broadcom.com>,
Sumit Saxena <sumit.saxena@broadcom.com>,
Nilesh Javali <njavali@marvell.com>,
Andrew Morton <akpm@linux-foundation.org>,
Himanshu Madhani <himanshu.madhani@oracle.com>,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org,
MPT-FusionLinux.pdl@broadcom.com, linux-scsi@vger.kernel.org,
mpi3mr-linuxdrv.pdl@broadcom.com,
GR-QLogic-Storage-Upstream@marvell.com
Subject: [PATCH 0/5] scsi: Avoid possible run-time warning with long manufacturer strings
Date: Tue, 9 Apr 2024 19:31:49 -0700 [thread overview]
Message-ID: <20240410021833.work.750-kees@kernel.org> (raw)
Hi,
Another code pattern using the gloriously ambiguous strncpy() function was
turning maybe not-NUL-terminated character arrays into NUL-terminated
strings. In these cases, when strncpy() is replaced with strscpy()
it creates a situation where if the non-terminated string takes up the
entire character array (i.e. it is not terminated) run-time warnings
from CONFIG_FORTIFY_SOURCE will trip, since strscpy() was expecting to
find a NUL-terminated source but checking for the NUL would walk off
the end of the source buffer.
In doing an instrumented build of the kernel to find these cases, it
seems it was almost entirely a code pattern used in the SCSI subsystem,
so the creation of the new helper, memtostr(), can land via the SCSI
tree. And, as it turns out, inappropriate conversions have been happening
for several years now, some of which even moved through strlcpy() first
(and were never noticed either).
This series fixes all 4 of the instances I could find in the SCSI
subsystem.
Thanks,
-Kees
Kees Cook (5):
string.h: Introduce memtostr() and memtostr_pad()
scsi: mptfusion: Avoid possible run-time warning with long
manufacturer strings
scsi: mpt3sas: Avoid possible run-time warning with long manufacturer
strings
scsi: mpi3mr: Avoid possible run-time warning with long manufacturer
strings
scsi: qla2xxx: Avoid possible run-time warning with long model_num
drivers/message/fusion/mptsas.c | 14 +++----
drivers/scsi/mpi3mr/mpi3mr_transport.c | 14 +++----
drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +++----
drivers/scsi/qla2xxx/qla_mr.c | 6 +--
include/linux/string.h | 49 ++++++++++++++++++++++++
lib/strscpy_kunit.c | 26 +++++++++++++
7 files changed, 93 insertions(+), 32 deletions(-)
--
2.34.1
next reply other threads:[~2024-04-10 2:31 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-10 2:31 Kees Cook [this message]
2024-04-10 2:31 ` [PATCH 1/5] string.h: Introduce memtostr() and memtostr_pad() Kees Cook
2024-04-10 4:08 ` Andy Shevchenko
2024-04-10 18:33 ` Kees Cook
2024-04-24 15:59 ` Kees Cook
2024-04-25 1:42 ` Martin K. Petersen
2024-04-10 2:31 ` [PATCH 2/5] scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings Kees Cook
2024-04-10 2:31 ` [PATCH 3/5] scsi: mpt3sas: " Kees Cook
2024-05-21 19:07 ` Ewan Milne
2024-04-10 2:31 ` [PATCH 4/5] scsi: mpi3mr: " Kees Cook
2024-04-10 2:31 ` [PATCH 5/5] scsi: qla2xxx: Avoid possible run-time warning with long model_num Kees Cook
2024-04-17 17:35 ` [PATCH 0/5] scsi: Avoid possible run-time warning with long manufacturer strings Kees Cook
2024-04-18 0:35 ` Martin K. Petersen
2024-04-18 17:40 ` Kees Cook
2024-04-25 1:55 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240410021833.work.750-kees@kernel.org \
--to=keescook@chromium.org \
--cc=GR-QLogic-Storage-Upstream@marvell.com \
--cc=MPT-FusionLinux.pdl@broadcom.com \
--cc=akpm@linux-foundation.org \
--cc=andy@kernel.org \
--cc=bvanassche@acm.org \
--cc=cbertsch@cox.net \
--cc=himanshu.madhani@oracle.com \
--cc=jejb@linux.ibm.com \
--cc=justinstitt@google.com \
--cc=kashyap.desai@broadcom.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=mpi3mr-linuxdrv.pdl@broadcom.com \
--cc=njavali@marvell.com \
--cc=sathya.prakash@broadcom.com \
--cc=sreekanth.reddy@broadcom.com \
--cc=suganath-prabu.subramani@broadcom.com \
--cc=sumit.saxena@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).