Skip to content

Commit 6cd5932

Browse files
azeemshaikh38kees
authored andcommitted
kobject: Replace strlcpy with strscpy
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value of -errno is used to check for truncation instead of sizeof(dest). [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] KSPP#89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230831140104.207019-1-azeemshaikh38@gmail.com Signed-off-by: Kees Cook <keescook@chromium.org>
1 parent 8ebab15 commit 6cd5932

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

lib/kobject_uevent.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -254,10 +254,10 @@ static int init_uevent_argv(struct kobj_uevent_env *env, const char *subsystem)
254254
int buffer_size = sizeof(env->buf) - env->buflen;
255255
int len;
256256

257-
len = strlcpy(&env->buf[env->buflen], subsystem, buffer_size);
258-
if (len >= buffer_size) {
259-
pr_warn("init_uevent_argv: buffer size of %d too small, needed %d\n",
260-
buffer_size, len);
257+
len = strscpy(&env->buf[env->buflen], subsystem, buffer_size);
258+
if (len < 0) {
259+
pr_warn("%s: insufficient buffer space (%u left) for %s\n",
260+
__func__, buffer_size, subsystem);
261261
return -ENOMEM;
262262
}
263263

0 commit comments

Comments
 (0)