While replacing strncpy() with strscpy(), Bart Van Assche pointed out
that the code occurs inside sysfs write callbacks, which already uses
NUL-terminated strings. This allows the string to be passed directly to
sscanf() without requiring a temporary copy.

Remove the deprecated and unnecessary strncpy() and the corresponding
local variables, and pass the buffer buf directly to sscanf().

Replace sscanf() with kstrtoint() to silence checkpatch warnings.

Compile-tested only.

Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Cc: Kees Cook <kees@kernel.org>
Cc: David Laight <david.laight.linux@gmail.com>
Suggested-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
Changes in v2:
- Adjust len to copy the same number of bytes as with strncpy()
- Link to v1: https://lore.kernel.org/r/20250212222214.86110-2-thorsten.blum@linux.dev/

Changes in v3:
- Remove strncpy() and tmpbuf et al and use buf directly as suggested by
  Bart Van Assche and Kees Cook
- Replace sscanf() with kstrtoint() as suggested by David Laight
- Link to v2: https://lore.kernel.org/linux-kernel/20250213195332.1464-3-thorsten.blum@linux.dev/
---
 drivers/scsi/hpsa.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 84d8de07b7ae..bb65954b1b1e 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -453,17 +453,13 @@ static ssize_t host_store_hp_ssd_smart_path_status(struct device *dev,
 					 struct device_attribute *attr,
 					 const char *buf, size_t count)
 {
-	int status, len;
+	int status;
 	struct ctlr_info *h;
 	struct Scsi_Host *shost = class_to_shost(dev);
-	char tmpbuf[10];
 
 	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
 		return -EACCES;
-	len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count;
-	strncpy(tmpbuf, buf, len);
-	tmpbuf[len] = '\0';
-	if (sscanf(tmpbuf, "%d", &status) != 1)
+	if (kstrtoint(buf, 10, &status))
 		return -EINVAL;
 	h = shost_to_hba(shost);
 	h->acciopath_status = !!status;
@@ -477,17 +473,13 @@ static ssize_t host_store_raid_offload_debug(struct device *dev,
 					 struct device_attribute *attr,
 					 const char *buf, size_t count)
 {
-	int debug_level, len;
+	int debug_level;
 	struct ctlr_info *h;
 	struct Scsi_Host *shost = class_to_shost(dev);
-	char tmpbuf[10];
 
 	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
 		return -EACCES;
-	len = count > sizeof(tmpbuf) - 1 ? sizeof(tmpbuf) - 1 : count;
-	strncpy(tmpbuf, buf, len);
-	tmpbuf[len] = '\0';
-	if (sscanf(tmpbuf, "%d", &debug_level) != 1)
+	if (kstrtoint(buf, 10, &debug_level))
 		return -EINVAL;
 	if (debug_level < 0)
 		debug_level = 0;
-- 
2.48.1

On Fri, 14 Feb 2025 12:43:02 +0100, Thorsten Blum wrote:

> While replacing strncpy() with strscpy(), Bart Van Assche pointed out
> that the code occurs inside sysfs write callbacks, which already uses
> NUL-terminated strings. This allows the string to be passed directly to
> sscanf() without requiring a temporary copy.
> 
> Remove the deprecated and unnecessary strncpy() and the corresponding
> local variables, and pass the buffer buf directly to sscanf().
> 
> [...]

Applied to 6.15/scsi-queue, thanks!

[1/1] scsi: hpsa: Remove deprecated and unnecessary strncpy()
      https://git.kernel.org/mkp/scsi/c/d69ddae194ca

-- 
Martin K. Petersen	Oracle Linux Engineering

Thorsten,

> While replacing strncpy() with strscpy(), Bart Van Assche pointed out
> that the code occurs inside sysfs write callbacks, which already uses
> NUL-terminated strings. This allows the string to be passed directly to
> sscanf() without requiring a temporary copy.

Applied to 6.15/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering

On 2/14/25 3:43 AM, Thorsten Blum wrote:
> While replacing strncpy() with strscpy(), Bart Van Assche pointed out
> that the code occurs inside sysfs write callbacks, which already uses
> NUL-terminated strings. This allows the string to be passed directly to
> sscanf() without requiring a temporary copy.
> 
> Remove the deprecated and unnecessary strncpy() and the corresponding
> local variables, and pass the buffer buf directly to sscanf().
> 
> Replace sscanf() with kstrtoint() to silence checkpatch warnings.

Reviewed-by: Bart Van Assche <bvanassche@acm.org>