On Wed, Jul 26, 2023 at 09:12:18PM +0000, justinstitt@xxxxxxxxxx wrote: > `strncpy` is deprecated for use on NUL-terminated destination strings [1]. > > A suitable replacement is `strscpy` [2] due to the fact that it > guarantees NUL-termination on its destination buffer argument which is > _not_ the case for `strncpy`! > > It was pretty difficult, in this case, to try and figure out whether or > not the destination buffer was zero-initialized. If it is and this > behavior is relied on then perhaps `strscpy_pad` is the preferred > option here. > > Kees was able to help me out and identify the following code snippet > which seems to show that the destination buffer is zero-initialized. > > | skl = devm_kzalloc(&pci->dev, sizeof(*skl), GFP_KERNEL); > > With this information, I opted for `strscpy` since padding is seemingly > not required. We did notice that str_elem->string is 44 bytes, but skl->lib_info[ref_count].name is 128 bytes. If str_elem->string isn't NUL-terminated, this can still hit an over-read condition (though CONFIG_FORTIFY_SOURCE would have caught it both before with strncpy() and now with strscpy()). So I assume it is expected to be NUL-terminated? > Also within this patch is a change to an instance of `x > y - 1` to `x >= y` > which tends to be more robust and readable. Consider, for instance, if `y` was > somehow `INT_MIN`. I'd split this change into a separate patch -- it's logically unrelated (but seems a reasonable cleanup). > > [1]: www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings > [2]: manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html > > Link: https://github.com/KSPP/linux/issues/90 > Suggested-by: Kees Cook <keescook@xxxxxxxxxxxx> > Signed-off-by: Justin Stitt <justinstitt@xxxxxxxxxx> > --- > sound/soc/intel/skylake/skl-topology.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c > index 96cfebded072..67f08ec3a2ea 100644 > --- a/sound/soc/intel/skylake/skl-topology.c > +++ b/sound/soc/intel/skylake/skl-topology.c > @@ -3154,12 +3154,12 @@ static int skl_tplg_fill_str_mfest_tkn(struct device *dev, > > switch (str_elem->token) { > case SKL_TKN_STR_LIB_NAME: > - if (ref_count > skl->lib_count - 1) { > + if (ref_count >= skl->lib_count) { > ref_count = 0; > return -EINVAL; > } > > - strncpy(skl->lib_info[ref_count].name, > + strscpy(skl->lib_info[ref_count].name, > str_elem->string, > ARRAY_SIZE(skl->lib_info[ref_count].name)); > ref_count++; > > --- > base-commit: 0b4a9fdc9317440a71d4d4c264a5650bf4a90f3c > change-id: 20230726-asoc-intel-skylake-remove-deprecated-strncpy-9dbcfc26040c > > Best regards, > -- > Justin Stitt <justinstitt@xxxxxxxxxx> > -- Kees Cook
