On Thu, 13 Feb 2025 12:34:55 -0800 Bart Van Assche <bvanassche@xxxxxxx> wrote: > On 2/13/25 11:53 AM, Thorsten Blum wrote: > > diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c > > index 84d8de07b7ae..c7ebae24b09f 100644 > > --- a/drivers/scsi/hpsa.c > > +++ b/drivers/scsi/hpsa.c > > @@ -460,9 +460,8 @@ static ssize_t host_store_hp_ssd_smart_path_status(struct device *dev, > > > > if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO)) > > return -EACCES; > > - len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count; > > - strncpy(tmpbuf, buf, len); > > - tmpbuf[len] = '\0'; > > + len = min(count + 1, sizeof(tmpbuf)); > > + strscpy(tmpbuf, buf, len); > > if (sscanf(tmpbuf, "%d", &status) != 1) > > return -EINVAL; > > h = shost_to_hba(shost); > > @@ -484,9 +483,8 @@ static ssize_t host_store_raid_offload_debug(struct device *dev, > > > > if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO)) > > return -EACCES; > > - len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count; > > - strncpy(tmpbuf, buf, len); > > - tmpbuf[len] = '\0'; > > + len = min(count + 1, sizeof(tmpbuf)); > > + strscpy(tmpbuf, buf, len); > > if (sscanf(tmpbuf, "%d", &debug_level) != 1) > > return -EINVAL; > > if (debug_level < 0) > > Something I should have noticed earlier: this code occurs inside sysfs > write callbacks. The strings passed to sysfs write callbacks are > 0-terminated. Hence, 'buf' can be passed directly to sscanf() and > tmpbuf[] can be removed. From kernfs_fop_write_iter() in fs/kernfs.c: > > buf[len] = '\0'; /* guarantee string termination */ You might also want to use one of the stroul() family rather than sscanf(). David. > > Thanks, > > Bart. >
