Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
To:     Azeem Shaikh <azeemshaikh38@gmail.com>
Cc:     James Smart <james.smart@broadcom.com>,
        Dick Kennedy <dick.kennedy@broadcom.com>,
        linux-hardening@vger.kernel.org, linux-scsi@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>
Subject: Re: [PATCH] scsi: lpfc: Replace all non-returning strlcpy with strscpy
From:   "Martin K. Petersen" <martin.petersen@oracle.com>
Organization: Oracle Corporation
Message-ID: <yq15y88dux4.fsf@ca-mkp.ca.oracle.com>
References: <20230530155745.343032-1-azeemshaikh38@gmail.com>
Date:   Wed, 31 May 2023 17:59:29 -0400
In-Reply-To: <20230530155745.343032-1-azeemshaikh38@gmail.com> (Azeem Shaikh's
        message of "Tue, 30 May 2023 15:57:45 +0000")
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?YSfMAXa5NH4WiEczcHIGANDL+X7I+z9HIwq8UUqphDYBtCp5f3vL2A/WX4q+?=
 =?us-ascii?Q?CEtyntT7Wjvm1CsMEANjzcpM7f2uUvym3snsWRf3P8MdVapeMsFtB8OalaNM?=
 =?us-ascii?Q?iTVdS+FY5xVwDz7Iv/MYLhOJExKkHFWv2iwU8r2etC/RVjZj5Kf/otwy18K7?=
 =?us-ascii?Q?uduCI1w6/WASAxnKHQMia0mmXaWr6cw6lLA9sOCPRYP2+pP90zJn4RKdB0CR?=
 =?us-ascii?Q?z07PWAFn2HfT8XgKhubbm0zJb7TQDIXauH2Wqv0dz1UHw4UqYhM+StIRJepy?=
 =?us-ascii?Q?pa87XwzVs5Z1Oc0F/xexo6II7447aasYZawy7dTtV+RSFqY0KHO9DRB8teIE?=
 =?us-ascii?Q?Baz+XkSgpKSVbGYJX4CtFXCr4ajzHiQabH4/FUO0C/5sry0ZWTCVY2c4Dfaq?=
 =?us-ascii?Q?bgIM9QX7oPq2/1PjQ/8iejO1O8vIJUHNY3wQXP1pY3bzu0fs/qjuTED/ST0b?=
 =?us-ascii?Q?p3E+JUxGZCLln56ea4Lba6vhKUk+6PWy+Lh63Em+VE8JOeC7F1D1bmQufJ3p?=
 =?us-ascii?Q?nxazI8ooDDqwi1IVhanitBq8ZuGtuRXNcDEwI7SQ4JGzRiqxOy9ds0Y5tMUm?=
 =?us-ascii?Q?QgP4Kf5lSSQK9gET0KlyOLfbT9s00rPaeQMhTPOLgINKvG5Wr649U/ZOzm2g?=
 =?us-ascii?Q?HzYbI0sgULpQkvHqpFtW+sMjDtCUDRGRjcL0HzQ2/PaqjD6D8/LSMmjuiVz3?=
 =?us-ascii?Q?X21RmsQDO3StYga5WOkIBDw/X1Z3J0TOFUBPCgDsuKsNpKprL1vkRBA+vKZ+?=
 =?us-ascii?Q?gT/H/PMoeF6D4N4QzE4EIG6zuRIZBajMSwrWYfOoDBgmvs676ryqoz/h7VBJ?=
 =?us-ascii?Q?X0Ft+t+b5+ujc+aChz3usUsQ1s+/SVK+RNVUM7NhorTCDac103Nie4qo5rh7?=
 =?us-ascii?Q?ocW5+xR74n40JzkwxC85zPBeEvrWwe5sapuI8wbzzH1GiU7nf94whNHrzKBN?=
 =?us-ascii?Q?unaEQTdtDUqTEpu7RcG+KvwR7tfWgOCFdtNizGqIcdX3QjSXm7U782bc1f1s?=
 =?us-ascii?Q?Y0DJ02retTHfmxfLYR7Q3SyKLf/BLv4skV/iWTGtBoxqVx+28sBxdP5pIaNO?=
 =?us-ascii?Q?YyS63pJDt5f/KNuVgDcnjMOIVPvJLTVM/Q2J4Sk8up75ckhStWbybDC8CAcW?=
 =?us-ascii?Q?OUbG313WBtjlNwMD7mqxXCaWo4qxfMvHbn2dIvUbK1xRBIPbi7kEk319Zdbe?=
 =?us-ascii?Q?O0j6bq74jGeUeQhiKVscSH+QBB3Ps4HfGG1aEoluQBMIn8z1t6r4psp50rwi?=
 =?us-ascii?Q?eig74JW4tTZvsSUJ2WkOgFcmXmImMZCECVqxPo6MbXHD6QsKCE7yoBiqfSHB?=
 =?us-ascii?Q?/BP4okMJBkEl/D6/oiekKZAZPUftmHyb/kqlIpuXiDJ49vAJwPaOOZsz8XeC?=
 =?us-ascii?Q?nf8qKGrCMrfi0B6dGwMYvTcATidok1qVuFVQdCKPvm2zesMJErTd6uQ4JtG7?=
 =?us-ascii?Q?Db9+aeAT304QoLSMkDIYDizBZe7EjoRinK8F0ufNczYYQ+rcvHT9WXDGONNA?=
 =?us-ascii?Q?WkJta/mRe57bwgi5QZ5KVcpfiWaF47D+rtW6k3kZfQS/4jbVz9guQlaiExCG?=
 =?us-ascii?Q?o9fPsefxjzIZrf57MYv09RxxRtHrLd/76PKzT3mG+pfw0sLr+Ez38/sRPVCj?=
 =?us-ascii?Q?pw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 8V9GGB8a4eHr3ZS9Es5CGox+6TmY8VyToqAAtLl3jmBHHdzQ2uHfhM9LSoeYYrVZYx/oyWxjkIcHTQEXsYCXDWD7FehRHfPVbO+gAQQS3zk8ZJw864sQa229p7E5q2KXzrCTYgrn6dVYEJ83Gg9FppX++wIJniGXCEzvUC6VKAZz12wJ9UuRMhejLS+wymkRQY3jC21jKBM00dOZroFw7hepUGnq2YEyh0/43+3M0VOrNtoqKo3uz4+dyN6OVhoJZwxwspiYowTw6uVy5JTiE7gBHdM/NxPPwnb/A9uXj8uLtuTJuVWm0e1Dqrk5T8hDP82xna8MbNcSHNbUfeGRJvRp0ZkOENuOtsUosPrRXffq6I2r1MQKv9O9Os4FRzdhCyq0iGRJ32QRZDKGetNzdItDl96gYx4x/GHO/tDmu731H5txVobTGucEyP6kmUyVsy3jR2I2a7pKhSBD1W2dcxiKgnMun7VNb6hnagkYwZtufEUk38txhqLV70ws/qW7m6xu9XeYEpbtAndcQ0vP1pT60M6K7yl+ZDaX97BW72Uqvs5mrdcTgKMPCj9eFbmlU8wp3XN7B0IrGV3fwzqY9i69GnhGRJAncycIW49FwE2WV+1agsCx5lMLQmR3xFMjsHqmNQV03zLqrnvwUzYTlDZ9bOzJYCG+vzvr/UXmpVyfg9MNxLe6p9Ska59BzvLfLFk8xvERo6U6wr9itZ3MndADtZJCkMn2Lzfv3UWGcPmZqN1BwdbEdvFuUdGsx7HqpgtOTnJ7nT1L2aSESeBjbX4XEv0alatAb3gt5+tK3kOHn1pJOmZ+Q7EG+Zb1vPc4vUb087r9hnn+aiwwU/5jsNNeG1EqpCeNnTAveX2rn70=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1ba6ec30-16c3-45de-cdd8-08db62225089
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2023 21:59:32.4265
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ES7+3xWoTEztH/fjxuxPaTlU+fb2uLFgdml4tIkaVzfxxKI8is7UGsYQxWfvm8XlyFtvuNr42vEwWws2+qVu4+2iF89OQUYbnEuvMgPMTBg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6854
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26
 definitions=2023-05-31_16,2023-05-31_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 malwarescore=0 phishscore=0
 bulkscore=0 adultscore=0 mlxscore=0 suspectscore=0 mlxlogscore=966
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2304280000
 definitions=main-2305310185
X-Proofpoint-ORIG-GUID: xvGh3TxDGXMJlFCrVtB6tGFHdVmf69yM
X-Proofpoint-GUID: xvGh3TxDGXMJlFCrVtB6tGFHdVmf69yM
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


Azeem,

> strlcpy() reads the entire source buffer first. This read may exceed
> the destination size limit. This is both inefficient and can lead to
> linear read overflows if a source string is not NUL-terminated [1]. In
> an effort to remove strlcpy() completely [2], replace strlcpy() here
> with strscpy(). No return values were used, so direct replacement is
> safe.

Applied to 6.5/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering