scsi: ch: Replace deprecated strncpy() with strscpy()

strncpy() is deprecated for use on NUL-terminated destination strings [1]
and as such we should prefer more robust and less ambiguous string
interfaces.

These labels get copied out to the user so lets make sure they are
NUL-terminated and NUL-padded.

vparams is already memset to 0 so we don't need to do any NUL-padding (like
what strncpy() is doing).

Considering the above, a suitable replacement is strscpy() [2] due to the
fact that it guarantees NUL-termination on the destination buffer without
unnecessarily NUL-padding.

Let's also opt to use the more idiomatic strscpy() usage of: (dest, src,
sizeof(dest)) as this more closely ties the destination buffer to the
length.

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings
Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html
Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20231023-strncpy-drivers-scsi-ch-c-v1-1-dc67ba8075a3@google.com
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index cb0a399be1ccee335a307e0a50889a36a4c3fdfb..2b864061e0730b98b6ee23c38ebd9f502aaf47c5 100644 (file)
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -659,19 +659,23 @@ static long ch_ioctl(struct file *file,
                memset(&vparams,0,sizeof(vparams));
                if (ch->counts[CHET_V1]) {
                        vparams.cvp_n1  = ch->counts[CHET_V1];
-                       strncpy(vparams.cvp_label1,vendor_labels[0],16);
+                       strscpy(vparams.cvp_label1, vendor_labels[0],
+                               sizeof(vparams.cvp_label1));
                }
                if (ch->counts[CHET_V2]) {
                        vparams.cvp_n2  = ch->counts[CHET_V2];
-                       strncpy(vparams.cvp_label2,vendor_labels[1],16);
+                       strscpy(vparams.cvp_label2, vendor_labels[1],
+                               sizeof(vparams.cvp_label2));
                }
                if (ch->counts[CHET_V3]) {
                        vparams.cvp_n3  = ch->counts[CHET_V3];
-                       strncpy(vparams.cvp_label3,vendor_labels[2],16);
+                       strscpy(vparams.cvp_label3, vendor_labels[2],
+                               sizeof(vparams.cvp_label3));
                }
                if (ch->counts[CHET_V4]) {
                        vparams.cvp_n4  = ch->counts[CHET_V4];
-                       strncpy(vparams.cvp_label4,vendor_labels[3],16);
+                       strscpy(vparams.cvp_label4, vendor_labels[3],
+                               sizeof(vparams.cvp_label4));
                }
                if (copy_to_user(argp, &vparams, sizeof(vparams)))
                        return -EFAULT;