replace strncpy with strscpy_pad

The strncpy() function is actively dangerous to use since it may not
NULL-terminate the destination string, resulting in potential memory
content exposures, unbounded reads, or crashes.
Link: https://github.com/KSPP/linux/issues/90
In addition, strscpy_pad is more appropriate because it also zero-fills
any remaining space in the destination if the source is shorter than
the provided buffer size.

Signed-off-by: Baris Can Goral <goralbaris@gmail.com>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://patch.msgid.link/20250521161036.14489-1-goralbaris@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/rds/connection.c b/net/rds/connection.c
index c749c5525b40f2961861378b65ce6f84d8ba2b4c..d62f486ab29fa40ef4fdad1797663daf25e7ae1d 100644 (file)
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -749,8 +749,7 @@ static int rds_conn_info_visitor(struct rds_conn_path *cp, void *buffer)
        cinfo->laddr = conn->c_laddr.s6_addr32[3];
        cinfo->faddr = conn->c_faddr.s6_addr32[3];
        cinfo->tos = conn->c_tos;
-       strncpy(cinfo->transport, conn->c_trans->t_name,
-               sizeof(cinfo->transport));
+       strscpy_pad(cinfo->transport, conn->c_trans->t_name);
        cinfo->flags = 0;
 
        rds_conn_info_set(cinfo->flags, test_bit(RDS_IN_XMIT, &cp->cp_flags),
@@ -775,8 +774,7 @@ static int rds6_conn_info_visitor(struct rds_conn_path *cp, void *buffer)
        cinfo6->next_rx_seq = cp->cp_next_rx_seq;
        cinfo6->laddr = conn->c_laddr;
        cinfo6->faddr = conn->c_faddr;
-       strncpy(cinfo6->transport, conn->c_trans->t_name,
-               sizeof(cinfo6->transport));
+       strscpy_pad(cinfo6->transport, conn->c_trans->t_name);
        cinfo6->flags = 0;
 
        rds_conn_info_set(cinfo6->flags, test_bit(RDS_IN_XMIT, &cp->cp_flags),