On Tue, Oct 10, 2023 at 4:07 AM Vladimir Oltean <olte...@gmail.com> wrote: > > Hello Justin, > > On Mon, Oct 09, 2023 at 10:43:59PM +0000, Justin Stitt wrote: > > `strncpy` is deprecated for use on NUL-terminated destination strings > > [1] and as such we should prefer more robust and less ambiguous string > > interfaces. > > > > ethtool_sprintf() is designed specifically for get_strings() usage. > > Let's replace strncpy in favor of this more robust and easier to > > understand interface. > > > > Link: > > https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings > > [1] > > Link: > > https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] > > Link: https://github.com/KSPP/linux/issues/90 > > Cc: linux-hardening@vger.kernel.org > > Signed-off-by: Justin Stitt <justinst...@google.com> > > --- > > Note: build-tested only. > > --- > > drivers/net/dsa/realtek/rtl8365mb.c | 3 +-- > > 1 file changed, 1 insertion(+), 2 deletions(-) > > > > diff --git a/drivers/net/dsa/realtek/rtl8365mb.c > > b/drivers/net/dsa/realtek/rtl8365mb.c > > index 41ea3b5a42b1..d171c18dd354 100644 > > --- a/drivers/net/dsa/realtek/rtl8365mb.c > > +++ b/drivers/net/dsa/realtek/rtl8365mb.c > > @@ -1303,8 +1303,7 @@ static void rtl8365mb_get_strings(struct dsa_switch > > *ds, int port, u32 stringset > > > > for (i = 0; i < RTL8365MB_MIB_END; i++) { > > struct rtl8365mb_mib_counter *mib = > > &rtl8365mb_mib_counters[i]; > > - > > - strncpy(data + i * ETH_GSTRING_LEN, mib->name, > > ETH_GSTRING_LEN); > > + ethtool_sprintf(&data, "%s", mib->name); > > Is there any particular reason why you opted for the "%s" printf format > specifier when you could have simply given mib->name as the single > argument? This comment applies to all the ethtool_sprintf() patches > you've submitted.
Yeah, it causes a -Wformat-security warning for me. I briefly mentioned it in one of my first patches like this [1]. [1]: https://lore.kernel.org/all/20231005-strncpy-drivers-net-dsa-lan9303-core-c-v2-1-feb452a53...@google.com/
