Replace the deprecated[1] strncpy() with strscpy() in
transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(),
transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().

All four functions follow the same pattern: a local
buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated
via sprintf()/snprintf() (always NUL-terminated), then conditionally
copied to p_buf with strncpy(). The p_buf destination is used as a
C string by all callers in target_core_configfs.c: strlen(buf) and
sprintf(page+len, "%s", buf) to build sysfs output.

NUL-padding is not required: callers in target_core_configfs.c
pre-zero p_buf with memset() or initializer before calling these
functions, and consume p_buf only as a NUL-terminated C string via
strlen() and "%s", never exposing trailing bytes.

No behavioral change: the source buf is always NUL-terminated and
shorter than VPD_TMP_BUF_SIZE, so strscpy() produces identical output.

Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
---
 drivers/target/target_core_transport.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index a7330c4fedde..a1b8f581185e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1112,7 +1112,7 @@ void transport_dump_vpd_proto_id(
 	}
 
 	if (p_buf)
-		strncpy(p_buf, buf, p_buf_len);
+		strscpy(p_buf, buf, p_buf_len);
 	else
 		pr_debug("%s", buf);
 }
@@ -1162,7 +1162,7 @@ int transport_dump_vpd_assoc(
 	}
 
 	if (p_buf)
-		strncpy(p_buf, buf, p_buf_len);
+		strscpy(p_buf, buf, p_buf_len);
 	else
 		pr_debug("%s", buf);
 
@@ -1222,7 +1222,7 @@ int transport_dump_vpd_ident_type(
 	if (p_buf) {
 		if (p_buf_len < strlen(buf)+1)
 			return -EINVAL;
-		strncpy(p_buf, buf, p_buf_len);
+		strscpy(p_buf, buf, p_buf_len);
 	} else {
 		pr_debug("%s", buf);
 	}
@@ -1276,7 +1276,7 @@ int transport_dump_vpd_ident(
 	}
 
 	if (p_buf)
-		strncpy(p_buf, buf, p_buf_len);
+		strscpy(p_buf, buf, p_buf_len);
 	else
 		pr_debug("%s", buf);
 
-- 
2.34.1

On Mon, 23 Mar 2026 10:13:15 -0700, Kees Cook wrote:

> Replace the deprecated[1] strncpy() with strscpy() in
> transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(),
> transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().
> 
> All four functions follow the same pattern: a local
> buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated
> via sprintf()/snprintf() (always NUL-terminated), then conditionally
> copied to p_buf with strncpy(). The p_buf destination is used as a
> C string by all callers in target_core_configfs.c: strlen(buf) and
> sprintf(page+len, "%s", buf) to build sysfs output.
> 
> [...]

Applied to 7.1/scsi-queue, thanks!

[1/1] scsi: target: Replace strncpy() with strscpy() in VPD dump functions
      https://git.kernel.org/mkp/scsi/c/665fb6a64319

-- 
Martin K. Petersen

Kees,

> Replace the deprecated[1] strncpy() with strscpy() in
> transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(),
> transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().

Applied to 7.1/scsi-staging, thanks!

-- 
Martin K. Petersen