In gbaudio_remove_controls() , replace the usage of strlcpy() with strscpy() because strlcpy() only limits the *destination* size, and the source is always read fully.
https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmkn... was quoted by checkpatch while showing this warning.
Signed-off-by: B K Karthik bkkarthik@pesu.pes.edu --- drivers/staging/greybus/audio_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c index 3011b8abce38..1ed4772d2771 100644 --- a/drivers/staging/greybus/audio_helper.c +++ b/drivers/staging/greybus/audio_helper.c @@ -166,7 +166,7 @@ static int gbaudio_remove_controls(struct snd_card *card, struct device *dev, snprintf(id.name, sizeof(id.name), "%s %s", prefix, control->name); else - strlcpy(id.name, control->name, sizeof(id.name)); + strscpy(id.name, control->name, sizeof(id.name)); id.numid = 0; id.iface = control->iface; id.device = control->device;
On Sat, Jan 09, 2021 at 06:57:31PM +0530, B K Karthik wrote:
In gbaudio_remove_controls() , replace the usage of strlcpy() with strscpy() because strlcpy() only limits the *destination* size, and the source is always read fully.
https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmkn... was quoted by checkpatch while showing this warning.
Signed-off-by: B K Karthik bkkarthik@pesu.pes.edu
drivers/staging/greybus/audio_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c index 3011b8abce38..1ed4772d2771 100644 --- a/drivers/staging/greybus/audio_helper.c +++ b/drivers/staging/greybus/audio_helper.c @@ -166,7 +166,7 @@ static int gbaudio_remove_controls(struct snd_card *card, struct device *dev, snprintf(id.name, sizeof(id.name), "%s %s", prefix, control->name); else
strlcpy(id.name, control->name, sizeof(id.name));
strscpy(id.name, control->name, sizeof(id.name));
Is this something that matters here? Isn't the string coming from the kernel (i.e. a trusted source), or if not, where is it coming from?
thanks,
greg k-h
-
B K Karthik -
Greg Kroah-Hartman