Received-SPF: pass (google.com: domain of linux-kernel+bounces-123825-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Thu, 28 Mar 2024 23:24:56 +0000
From: Justin Stitt <justinstitt@google.com>
To: Arnd Bergmann <arnd@kernel.org>
Cc: linux-kernel@vger.kernel.org, 
	"Richard Russon (FlatCap)" <ldm@flatcap.org>, Jens Axboe <axboe@kernel.dk>, Arnd Bergmann <arnd@arndb.de>, 
	linux-ntfs-dev@lists.sourceforge.net, linux-block@vger.kernel.org
Subject: Re: [PATCH 07/11] block/partitions/ldm: convert strncpy() to
 strscpy()
Message-ID: <a5vkpjykxex64vti4wvx7h64jthw7inc23uelol5s3beezoiuz@scl2uhf6pkl7>
References: <20240328140512.4148825-1-arnd@kernel.org>
 <20240328140512.4148825-8-arnd@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240328140512.4148825-8-arnd@kernel.org>

Hi,

On Thu, Mar 28, 2024 at 03:04:51PM +0100, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
> 
> The strncpy() here can cause a non-terminated string, which older gcc
> versions such as gcc-9 warn about:
> 
> In function 'ldm_parse_tocblock',
>     inlined from 'ldm_validate_tocblocks' at block/partitions/ldm.c:386:7,
>     inlined from 'ldm_partition' at block/partitions/ldm.c:1457:7:
> block/partitions/ldm.c:134:2: error: 'strncpy' specified bound 16 equals destination size [-Werror=stringop-truncation]
>   134 |  strncpy (toc->bitmap1_name, data + 0x24, sizeof (toc->bitmap1_name));
>       |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> block/partitions/ldm.c:145:2: error: 'strncpy' specified bound 16 equals destination size [-Werror=stringop-truncation]
>   145 |  strncpy (toc->bitmap2_name, data + 0x46, sizeof (toc->bitmap2_name));
>       |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> New versions notice that the code is correct after all because of the
> following termination, but replacing the strncpy() with strscpy_pad()
> or strcpy() avoids the warning and simplifies the code at the same time.
> 
> Use the padding version here to keep the existing behavior, in case
> the code relies on not including uninitialized data.
> 
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Thanks for the patch!

This helps towards: https://github.com/KSPP/linux/issues/90

Reviewed-by: Justin Stitt <justinstitt@google.com>

> ---
>  block/partitions/ldm.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
> index 38e58960ae03..2bd42fedb907 100644
> --- a/block/partitions/ldm.c
> +++ b/block/partitions/ldm.c
> @@ -131,8 +131,7 @@ static bool ldm_parse_tocblock (const u8 *data, struct tocblock *toc)
>  		ldm_crit ("Cannot find TOCBLOCK, database may be corrupt.");
>  		return false;
>  	}
> -	strncpy (toc->bitmap1_name, data + 0x24, sizeof (toc->bitmap1_name));
> -	toc->bitmap1_name[sizeof (toc->bitmap1_name) - 1] = 0;
> +	strscpy_pad(toc->bitmap1_name, data + 0x24, sizeof(toc->bitmap1_name));
>  	toc->bitmap1_start = get_unaligned_be64(data + 0x2E);
>  	toc->bitmap1_size  = get_unaligned_be64(data + 0x36);
>  
> @@ -142,8 +141,7 @@ static bool ldm_parse_tocblock (const u8 *data, struct tocblock *toc)
>  				TOC_BITMAP1, toc->bitmap1_name);
>  		return false;
>  	}
> -	strncpy (toc->bitmap2_name, data + 0x46, sizeof (toc->bitmap2_name));
> -	toc->bitmap2_name[sizeof (toc->bitmap2_name) - 1] = 0;
> +	strscpy_pad(toc->bitmap2_name, data + 0x46, sizeof(toc->bitmap2_name));
>  	toc->bitmap2_start = get_unaligned_be64(data + 0x50);
>  	toc->bitmap2_size  = get_unaligned_be64(data + 0x58);
>  	if (strncmp (toc->bitmap2_name, TOC_BITMAP2,
> -- 
> 2.39.2
> 

Thanks
Justin