strlcpy() takes the full destination buffer size, including room for the
NUL terminator, and copies at most size - 1 characters. The vendor,
product and revision fields of struct blk_desc are declared
char[BLK_*_SIZE + 1], so passing BLK_*_SIZE drops the last character of a
maximum-length string.
This dates from the conversion of these copies from strncpy() to
strlcpy(), which kept the size argument unchanged even though the two
functions interpret it differently. The original was correct:
strncpy(desc->vendor, ..., BLK_VEN_SIZE);
desc->vendor[BLK_VEN_SIZE] = '\0';
copying up to BLK_VEN_SIZE characters into a BLK_VEN_SIZE + 1 byte
buffer, where strlcpy(..., BLK_VEN_SIZE) copies only BLK_VEN_SIZE - 1.
An 8-character firmware revision such as "HDX 5.08" on a SanDisk
CompactFlash card is therefore reported by "ide info" as "HDX 5.0". The
boot-time banner is unaffected, as it prints the local blk_desc filled
by ide_ident() before this copy.
Pass sizeof() the destination instead.
Fixes: db89e72302d0 ("ide: Move setting of vendor strings into ide_probe()")
Signed-off-by: Graeme Harker <[email protected]>
---
drivers/block/ide.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/block/ide.c b/drivers/block/ide.c
index c1a46dd2a94..44ce054bdf5 100644
--- a/drivers/block/ide.c
+++ b/drivers/block/ide.c
@@ -1045,9 +1045,9 @@ static int ide_probe(struct udevice *udev)
/* fill in device vendor/product/rev strings */
desc = dev_get_uclass_plat(blk);
- strlcpy(desc->vendor, pdesc.vendor, BLK_VEN_SIZE);
- strlcpy(desc->product, pdesc.product, BLK_PRD_SIZE);
- strlcpy(desc->revision, pdesc.revision, BLK_REV_SIZE);
+ strlcpy(desc->vendor, pdesc.vendor, sizeof(desc->vendor));
+ strlcpy(desc->product, pdesc.product, sizeof(desc->product));
+ strlcpy(desc->revision, pdesc.revision, sizeof(desc->revision));
desc->removable = pdesc.removable;
desc->atapi = pdesc.atapi;
desc->lba48 = pdesc.lba48;
---
base-commit: 67a095a6896828056e4a1a0ba0e9bb20f5595c59
change-id: 20260829-ide-strlcpy-fix-83225ba994d5
Best regards,
--
Graeme Harker <[email protected]>
