[PATCH] staging: greybus: fix string termination in firmware sample

[Kurmapu Sai Devansh Prasad]

The firmware_tag string copied via strncpy() is not guaranteed to be
NUL-terminated if the source string is exactly the size of the destination
buffer. This can lead to a buffer over-read.

 Since alternatives like strscpy_pad cannot be used in user space
sample code, we can make it  safer by limiting the copy size to
MAX_SIZE - 1 and explicitly assigning the last byte to be a NUL
terminator. This ensures the string is always
safely terminated before being passed to the ioctl.

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings

This is my very first patch to the Linux kernel! I've been learning the
process and would deeply appreciate any feedback from the maintainers.

Signed-off-by: Kurmapu Sai Devansh Prasad <btech10487.26@xxxxxxxxxxxxxx>
---
 .../greybus/Documentation/firmware/firmware.c        | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/greybus/Documentation/firmware/firmware.c
b/drivers/staging/greybus/Documentation/firmware/firmware.c
index 3b35ef6d4adb..a6a0988ad6fe 100644
--- a/drivers/staging/greybus/Documentation/firmware/firmware.c
+++ b/drivers/staging/greybus/Documentation/firmware/firmware.c
@@ -64,7 +64,9 @@ static int update_intf_firmware(int fd)
        intf_load.minor = 0;

        strncpy((char *)&intf_load.firmware_tag, firmware_tag,
-               GB_FIRMWARE_U_TAG_MAX_SIZE);
+               GB_FIRMWARE_U_TAG_MAX_SIZE - 1);
+       ((char *)&intf_load.firmware_tag)[GB_FIRMWARE_U_TAG_MAX_SIZE - 1] =
+               '\0';

        ret = ioctl(fd, FW_MGMT_IOC_INTF_LOAD_AND_VALIDATE, &intf_load);
        if (ret < 0) {
@@ -102,7 +104,9 @@ static int update_backend_firmware(int fd)
        printf("Getting Backend Firmware Version\n");

        strncpy((char *)&backend_fw_info.firmware_tag, firmware_tag,
-               GB_FIRMWARE_U_TAG_MAX_SIZE);
+               GB_FIRMWARE_U_TAG_MAX_SIZE - 1);
+       ((char *)&backend_fw_info.firmware_tag)[GB_FIRMWARE_U_TAG_MAX_SIZE
- 1] =
+               '\0';

 retry_fw_version:
        ret = ioctl(fd, FW_MGMT_IOC_GET_BACKEND_FW, &backend_fw_info);
@@ -130,7 +134,9 @@ static int update_backend_firmware(int fd)
        printf("Updating Backend Firmware\n");

        strncpy((char *)&backend_update.firmware_tag, firmware_tag,
-               GB_FIRMWARE_U_TAG_MAX_SIZE);
+               GB_FIRMWARE_U_TAG_MAX_SIZE - 1);
+       ((char *)&backend_update.firmware_tag)[GB_FIRMWARE_U_TAG_MAX_SIZE - 1] =
+               '\0';

 retry_fw_update:
        backend_update.status = 0;
-- 
2.56.0