• Laurent Pinchart's avatar
    drm: property: Replace strncpy() with strscpy_pad() · 753f2674
    Laurent Pinchart authored
    strncpy() is widely regarded as unsafe due to the fact that it may leave
    the destination string without a nul-termination when the source string
    size is too large. When compiling the kernel with W=1, the gcc warns
    about this:
    
    drivers/gpu/drm/drm_property.c: In function ‘drm_property_create’:
    drivers/gpu/drm/drm_property.c:130:2: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
      130 |  strncpy(property->name, name, DRM_PROP_NAME_LEN);
          |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    There are three occurrences of strncpy() in drm_property.c. None of them
    are actually unsafe, as the very next line forces nul-termination of the
    destination buffer. The warning is thus a false positive, but adds noise
    to the kernel log. It can easily be silenced by using strscpy_pad()
    instead. Do so.
    
    One of the three occurrences, in drm_property_add_enum(), fills a char
    array that is later copied to userspace with copy_to_user() in
    drm_mode_getproperty_ioctl(). To avoid leaking kernel data,
    strscpy_pad() is required. Similarly, a second occurrence, in
    drm_mode_getproperty_ioctl(), copies the string to an ioctl data buffer
    that isn't previously zero'ed, to strscpy_pad() is also required. The
    last occurrence, in drm_property_create(), would be safe to replace with
    strscpy(), as the destination buffer is copied to userspace with
    strscpy_pad(). However, given that this isn't in a hot path, let's avoid
    future data leaks in case someone copies the whole char array blindly.
    Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
    753f2674
drm_property.c 27.3 KB