The legacy struct blk_user_trace_setup has a 32-byte name field, while buts2->name is a 64-byte buffer (BLKTRACE_BDEV_SIZE2). Since commit 113cbd62824a ("blktrace: pass blk_user_trace2 to setup functions"), blk_trace_setup() copied buts2->name into buts->name using strcpy(). strcpy() performs no bounds checking on the destination buffer, which can overflow if the source string exceeds 31 characters. Replace deprecated [1] strcpy() with strscpy() to ensure proper bounds checking and prevent potential buffer overflow. Link: https://github.com/KSPP/linux/issues/88 [1] Fixes: 113cbd62824a ("blktrace: pass blk_user_trace2 to setup functions") Signed-off-by: Huiwen He --- kernel/trace/blktrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index d031c8d80be4..50460e2e7212 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -793,7 +793,7 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev, return PTR_ERR(bt); } blk_trace_setup_finalize(q, name, 1, bt, &buts2); - strcpy(buts.name, buts2.name); + strscpy(buts.name, buts2.name); mutex_unlock(&q->debugfs_mutex); if (copy_to_user(arg, &buts, sizeof(buts))) { -- 2.25.1