This is a note to let you know that I've just added the patch titled
net: hns3: fix strncpy() not using dest-buf length as length issue
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-hns3-fix-strncpy-not-using-dest-buf-length-as-le.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit c7bac058c0b91ef65d58a3020117d8bad2853616
Author: Hao Chen <chenhao418@xxxxxxxxxx>
Date: Wed Jun 21 20:33:08 2023 +0800
net: hns3: fix strncpy() not using dest-buf length as length issue
[ Upstream commit 1cf3d5567f273a8746d1bade00633a93204f80f0 ]
Now, strncpy() in hns3_dbg_fill_content() use src-length as copy-length,
it may result in dest-buf overflow.
This patch is to fix intel compile warning for csky-linux-gcc (GCC) 12.1.0
compiler.
The warning reports as below:
hclge_debugfs.c:92:25: warning: 'strncpy' specified bound depends on
the length of the source argument [-Wstringop-truncation]
strncpy(pos, items[i].name, strlen(items[i].name));
hclge_debugfs.c:90:25: warning: 'strncpy' output truncated before
terminating nul copying as many bytes from a string as its length
[-Wstringop-truncation]
strncpy(pos, result[i], strlen(result[i]));
strncpy() use src-length as copy-length, it may result in
dest-buf overflow.
So,this patch add some values check to avoid this issue.
Signed-off-by: Hao Chen <chenhao418@xxxxxxxxxx>
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Closes: https://lore.kernel.org/lkml/202207170606.7WtHs9yS-lkp@xxxxxxxxx/T/
Signed-off-by: Hao Lan <lanhao@xxxxxxxxxx>
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
index bcccd82a2620f..f6ededec5a4fa 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -435,19 +435,36 @@ static void hns3_dbg_fill_content(char *content, u16 len,
const struct hns3_dbg_item *items,
const char **result, u16 size)
{
+#define HNS3_DBG_LINE_END_LEN 2
char *pos = content;
+ u16 item_len;
u16 i;
+ if (!len) {
+ return;
+ } else if (len <= HNS3_DBG_LINE_END_LEN) {
+ *pos++ = '\0';
+ return;
+ }
+
memset(content, ' ', len);
- for (i = 0; i < size; i++) {
- if (result)
- strncpy(pos, result[i], strlen(result[i]));
- else
- strncpy(pos, items[i].name, strlen(items[i].name));
+ len -= HNS3_DBG_LINE_END_LEN;
- pos += strlen(items[i].name) + items[i].interval;
+ for (i = 0; i < size; i++) {
+ item_len = strlen(items[i].name) + items[i].interval;
+ if (len < item_len)
+ break;
+
+ if (result) {
+ if (item_len < strlen(result[i]))
+ break;
+ strscpy(pos, result[i], strlen(result[i]));
+ } else {
+ strscpy(pos, items[i].name, strlen(items[i].name));
+ }
+ pos += item_len;
+ len -= item_len;
}
-
*pos++ = '\n';
*pos++ = '\0';
}
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c
index 142415c84c6b2..0ebc21401b7c2 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c
@@ -87,16 +87,35 @@ static void hclge_dbg_fill_content(char *content, u16 len,
const struct hclge_dbg_item *items,
const char **result, u16 size)
{
+#define HCLGE_DBG_LINE_END_LEN 2
char *pos = content;
+ u16 item_len;
u16 i;
+ if (!len) {
+ return;
+ } else if (len <= HCLGE_DBG_LINE_END_LEN) {
+ *pos++ = '\0';
+ return;
+ }
+
memset(content, ' ', len);
+ len -= HCLGE_DBG_LINE_END_LEN;
+
for (i = 0; i < size; i++) {
- if (result)
- strncpy(pos, result[i], strlen(result[i]));
- else
- strncpy(pos, items[i].name, strlen(items[i].name));
- pos += strlen(items[i].name) + items[i].interval;
+ item_len = strlen(items[i].name) + items[i].interval;
+ if (len < item_len)
+ break;
+
+ if (result) {
+ if (item_len < strlen(result[i]))
+ break;
+ strscpy(pos, result[i], strlen(result[i]));
+ } else {
+ strscpy(pos, items[i].name, strlen(items[i].name));
+ }
+ pos += item_len;
+ len -= item_len;
}
*pos++ = '\n';
*pos++ = '\0';
