`strncpy` is deprecated for use on NUL-terminated destination strings [1]. We can massively simplify the implementation by removing the ternary check for the smaller of `count` and `sizeof(buffer) - 1` as `strscpy` guarantees NUL-termination of its destination buffer [2]. This also means we do not need to explicity set the one past-the-last index to zero as `strscpy` handles this. Furthermore, we can also utilize `strscpy`'s return value to populate `len` and simply pass in `sizeof(buffer)` to the `strscpy` invocation itself. [1]: www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [2]: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@xxxxxxxxxxxxxxx Signed-off-by: Justin Stitt <justinstitt@xxxxxxxxxx> --- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c index dfe0f74369e6..8f2a834dbe04 100644 --- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c @@ -1462,15 +1462,12 @@ static ssize_t scan_age_store(struct device *d, struct device_attribute *attr, struct ipw_priv *priv = dev_get_drvdata(d); struct net_device *dev = priv->net_dev; char buffer[] = "00000000"; - unsigned long len = - (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1; unsigned long val; char *p = buffer; IPW_DEBUG_INFO("enter\n"); - strncpy(buffer, buf, len); - buffer[len] = 0; + ssize_t len = strscpy(buffer, buf, sizeof(buffer)); if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') { p++; --- base-commit: 5d0c230f1de8c7515b6567d9afba1f196fb4e2f4 change-id: 20230801-drivers-net-wireless-intel-ipw2x00-d7ee2dd17032 Best regards, -- Justin Stitt <justinstitt@xxxxxxxxxx>
