In bnxt_re_register_ib(), strscpy() is called with the length of the
source string rather than the size of the destination buffer.

This is fine as long as the destination buffer is larger than the source
string, but we should still use the destination buffer size instead to
call strscpy() as intended. And since 'node_desc' has a fixed size, we
can safely omit the size argument and let strscpy() infer it using
sizeof().

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 drivers/infiniband/hw/bnxt_re/main.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index df7cf8d68e27..0718421bbf09 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1323,8 +1323,7 @@ static int bnxt_re_register_ib(struct bnxt_re_dev *rdev)
 
 	/* ib device init */
 	ibdev->node_type = RDMA_NODE_IB_CA;
-	strscpy(ibdev->node_desc, BNXT_RE_DESC " HCA",
-		strlen(BNXT_RE_DESC) + 5);
+	strscpy(ibdev->node_desc, BNXT_RE_DESC " HCA");
 	ibdev->phys_port_cnt = 1;
 
 	addrconf_addr_eui48((u8 *)&ibdev->node_guid, rdev->netdev->dev_addr);
-- 
2.51.0

On Mon, 01 Sep 2025 17:00:39 +0200, Thorsten Blum wrote:
> In bnxt_re_register_ib(), strscpy() is called with the length of the
> source string rather than the size of the destination buffer.
> 
> This is fine as long as the destination buffer is larger than the source
> string, but we should still use the destination buffer size instead to
> call strscpy() as intended. And since 'node_desc' has a fixed size, we
> can safely omit the size argument and let strscpy() infer it using
> sizeof().
> 
> [...]

Applied, thanks!

[1/1] RDMA/bnxt_re: Call strscpy() with correct size argument
      https://git.kernel.org/rdma/rdma/c/9eda7148f0f78f

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>