Bug 49461 - scsi/bfa/bfad.c:1037: possible off by one in strncpy ?
Summary: scsi/bfa/bfad.c:1037: possible off by one in strncpy ?
Status: RESOLVED CODE_FIX
Alias: None
Product: IO/Storage
Classification: Unclassified
Component: SCSI (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: linux-scsi@vger.kernel.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-24 16:51 UTC by David Binderman
Modified: 2013-11-19 22:35 UTC (History)
2 users (show)

See Also:
Kernel Version: 3.7-rc2
Subsystem:
Regression: No
Bisected commit-id:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Binderman 2012-10-24 16:51:45 UTC 
The above source code is

    if (os_name)
        strncpy(driver_info.host_os_name, os_name,
            sizeof(driver_info.host_os_name) - 1);
    if (os_patch)
        strncpy(driver_info.host_os_patch, os_patch,
            sizeof(driver_info.host_os_patch) - 1);

    strncpy(driver_info.os_device_name, bfad->pci_name,
        sizeof(driver_info.os_device_name - 1));

The last strncpy doesn't match the style of the previous ones.
Maybe it should.
Comment 1 Jeff Zhou 2013-08-29 04:44:20 UTC 
In 3.10.9, it is correct:
scsi/bfa/bfad.c : 1036
	strncpy(driver_info.os_device_name, bfad->pci_name,
		sizeof(driver_info.os_device_name) - 1);

scsi/bfa/bfad.c : 1014	
struct bfa_fcs_driver_info_s driver_info;

scsi/bfa/bfa_fcs.h : 672
struct bfa_fcs_driver_info_s {
	u8	 version[BFA_VERSION_LEN];		/* Driver Version */
	u8	 host_machine_name[BFA_FCS_OS_STR_LEN];
	u8	 host_os_name[BFA_FCS_OS_STR_LEN]; /* OS name and version */
	u8	 host_os_patch[BFA_FCS_OS_STR_LEN]; /* patch or service pack */
	u8	 os_device_name[BFA_FCS_OS_STR_LEN]; /* Driver Device Name */
};

The copy length here is (BFA_FCS_OS_STR_LEN - 1), which should be.
Note You need to log in before you can comment on or make changes to this bug.