Re: [PATCH RESEND] scsi: scsi_ioctl: use strnlen in scsi_ioctl_get_pci

[David Laight]

On Sun, 17 May 2026 19:15:47 +0200
Thorsten Blum <thorsten.blum@xxxxxxxxx> wrote:

> Use strnlen() to limit string scanning to 20 characters.

Should that code write the trailing '\0'?
Looks like it has been broken since 2.6.29.
Prior to that it always wrote 20 bytes (changing from 8 bytes in 2.5.0)

I think it needs:
	char buf[20];
	int len = strscpy(buf, name);
	if (copy_to_user(arg, buf, len < 0 ? sizeof (buf) : len + 1))
		return -EFAULT;

-- David


> 
> Reformat the code and use tabs instead of spaces while at it.
> 
> Signed-off-by: Thorsten Blum <thorsten.blum@xxxxxxxxx>
> ---
>  drivers/scsi/scsi_ioctl.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
> index 0ddc95bafc71..d98c2f19b1e9 100644
> --- a/drivers/scsi/scsi_ioctl.c
> +++ b/drivers/scsi/scsi_ioctl.c
> @@ -176,10 +176,11 @@ static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg)
>  
>  	name = dev_name(dev);
>  
> -	/* compatibility with old ioctl which only returned
> -	 * 20 characters */
> -        return copy_to_user(arg, name, min(strlen(name), (size_t)20))
> -		? -EFAULT: 0;
> +	/* compatibility with old ioctl which only returned 20 characters */
> +	if (copy_to_user(arg, name, strnlen(name, 20)))
> +		return -EFAULT;
> +
> +	return 0;
>  }
>  
>  static int sg_get_version(int __user *p)
>