From 9114eb9d60f2c4a52f05e3a33b0d6b8ca4856cac Mon Sep 17 00:00:00 2001 From: Kurmapu Sai Devansh Prasad btech10487.26@bitmesra.ac.in Date: Mon, 2 Nov 2026 19:11:09 +0530 Subject: [PATCH] staging: greybus: fix string termination in firmware sample
The firmware_tag string copied via strncpy() is not guaranteed to be NUL-terminated if the source string is exactly the size of the destination buffer. This can lead to a buffer over-read.
Since alternatives like strscpy_pad cannot be used in user space sample code, we can make it safer by limiting the copy size to MAX_SIZE - 1 and explicitly assigning the last byte to be a NUL terminator. This ensures the string is always safely terminated before being passed to the ioctl.
Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nu...
This is my very first patch to the Linux kernel! I've been learning the process and would deeply appreciate any feedback from the maintainers.
Signed-off-by: Kurmapu Sai Devansh Prasad btech10487.26@bitmesra.ac.in --- .../greybus/Documentation/firmware/firmware.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/greybus/Documentation/firmware/firmware.c b/drivers/staging/greybus/Documentation/firmware/firmware.c index 3b35ef6d4adb..a6a0988ad6fe 100644 --- a/drivers/staging/greybus/Documentation/firmware/firmware.c +++ b/drivers/staging/greybus/Documentation/firmware/firmware.c @@ -64,7 +64,9 @@ static int update_intf_firmware(int fd) intf_load.minor = 0;
strncpy((char *)&intf_load.firmware_tag, firmware_tag, - GB_FIRMWARE_U_TAG_MAX_SIZE); + GB_FIRMWARE_U_TAG_MAX_SIZE - 1); + ((char *)&intf_load.firmware_tag)[GB_FIRMWARE_U_TAG_MAX_SIZE - 1] = + '\0';
ret = ioctl(fd, FW_MGMT_IOC_INTF_LOAD_AND_VALIDATE, &intf_load); if (ret < 0) { @@ -102,7 +104,9 @@ static int update_backend_firmware(int fd) printf("Getting Backend Firmware Version\n");
strncpy((char *)&backend_fw_info.firmware_tag, firmware_tag, - GB_FIRMWARE_U_TAG_MAX_SIZE); + GB_FIRMWARE_U_TAG_MAX_SIZE - 1); + ((char *)&backend_fw_info.firmware_tag)[GB_FIRMWARE_U_TAG_MAX_SIZE - 1] = + '\0';
retry_fw_version: ret = ioctl(fd, FW_MGMT_IOC_GET_BACKEND_FW, &backend_fw_info); @@ -130,7 +134,9 @@ static int update_backend_firmware(int fd) printf("Updating Backend Firmware\n");
strncpy((char *)&backend_update.firmware_tag, firmware_tag, - GB_FIRMWARE_U_TAG_MAX_SIZE); + GB_FIRMWARE_U_TAG_MAX_SIZE - 1); + ((char *)&backend_update.firmware_tag)[GB_FIRMWARE_U_TAG_MAX_SIZE - 1] = + '\0';
retry_fw_update: backend_update.status = 0;