drivers/xen/: user strlcpy() instead of strncpy() ... for being the safer alternative. In blktap2, snprintf() also gets replaced by strlcpy(), and the bounds check in blktap_sysfs_set_name() also gets adjusted. Signed-off-by: Jan Beulich --- a/drivers/xen/blktap/xenbus.c +++ b/drivers/xen/blktap/xenbus.c @@ -72,24 +72,22 @@ static int strsep_len(const char *str, c return i; len--; } - return (len == 0) ? i : -ERANGE; + return -ERANGE; } static long get_id(const char *str) { - int len,end; + int len; const char *ptr; - char *tptr, num[10]; + char num[10]; len = strsep_len(str, '/', 2); - end = strlen(str); - if ( (len < 0) || (end < 0) ) return -1; + if (len < 0) + return -1; ptr = str + len + 1; - strncpy(num,ptr,end - len); - tptr = num + (end - (len + 1)); - *tptr = '\0'; - DPRINTK("Get_id called for %s (%s)\n",str,num); + strlcpy(num, ptr, ARRAY_SIZE(num)); + DPRINTK("get_id(%s) -> %s\n", str, num); return simple_strtol(num, NULL, 10); } --- a/drivers/xen/blktap2/sysfs.c +++ b/drivers/xen/blktap2/sysfs.c @@ -65,12 +65,12 @@ blktap_sysfs_set_name(struct class_devic goto out; } - if (strnlen(buf, BLKTAP2_MAX_MESSAGE_LEN) >= BLKTAP2_MAX_MESSAGE_LEN) { + if (strnlen(buf, size) >= size) { err = -EINVAL; goto out; } - snprintf(tap->params.name, sizeof(tap->params.name) - 1, "%s", buf); + strlcpy(tap->params.name, buf, size); err = size; out: --- a/drivers/xen/usbback/usbstub.c +++ b/drivers/xen/usbback/usbstub.c @@ -110,7 +110,7 @@ int portid_add(const char *busid, portid->handle = handle; portid->portnum = portnum; - strncpy(portid->phys_bus, busid, BUS_ID_SIZE); + strlcpy(portid->phys_bus, busid, BUS_ID_SIZE); spin_lock_irqsave(&port_list_lock, flags); list_add(&portid->id_list, &port_list); --- a/drivers/xen/xenoprof/xenoprofile.c +++ b/drivers/xen/xenoprof/xenoprofile.c @@ -553,9 +553,8 @@ int __init xenoprofile_init(struct oprof xenoprof_arch_init_counter(&init); xenoprof_is_primary = init.is_primary; - /* cpu_type is detected by Xen */ - cpu_type[XENOPROF_CPU_TYPE_SIZE-1] = 0; - strncpy(cpu_type, init.cpu_type, XENOPROF_CPU_TYPE_SIZE - 1); + /* cpu_type is detected by Xen */ + strlcpy(cpu_type, init.cpu_type, XENOPROF_CPU_TYPE_SIZE); xenoprof_ops.cpu_type = cpu_type; init_driverfs();