Skip to content

πŸ›‘οΈ Sentinel: [MEDIUM] Fix unbounded strcpy in ar8327 LED driver#85

Merged
ManupaKDU merged 4 commits into
mainfrom
sentinel-ar8327-strscpy-3457645063388007658
May 22, 2026
Merged

πŸ›‘οΈ Sentinel: [MEDIUM] Fix unbounded strcpy in ar8327 LED driver#85
ManupaKDU merged 4 commits into
mainfrom
sentinel-ar8327-strscpy-3457645063388007658

Conversation

@ManupaKDU
Copy link
Copy Markdown

🚨 Severity: MEDIUM
πŸ’‘ Vulnerability: Unbounded strcpy in ar8327_led_create could lead to buffer overflows when copying the LED name into a dynamically allocated flexible array member. Additionally, strlen was called separately during allocation and copying, potentially leading to TOCTOU races if the name changed in the interim.
🎯 Impact: Potential kernel memory corruption or out-of-bounds writes if a maliciously crafted or overly long LED name is provided via the device tree or other initialization paths.
πŸ”§ Fix: Replaced strcpy with strscpy, precalculated the name length in a local variable name_len, and used it for both memory allocation and bounds checking in strscpy.
βœ… Verification: Verified that the patch applies cleanly, strscpy correctly bounds the copy, and no syntax errors or regressions were introduced. Run sh test_ci.sh locally.


PR created automatically by Jules for task 3457645063388007658 started by @manupawickramasinghe

Replaced `strcpy` with `strscpy` in `target/linux/generic/files/drivers/net/phy/ar8327.c` to prevent potential buffer overflows. Also precalculated `name_len` to avoid calling `strlen` twice and prevent TOCTOU races between allocation and copying.

Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>
@google-labs-jules
Copy link
Copy Markdown

πŸ‘‹ Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a πŸ‘€ emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

google-labs-jules Bot and others added 3 commits May 22, 2026 02:13
…7 LED driver

Replaced `strcpy` with `strscpy` in `target/linux/generic/files/drivers/net/phy/ar8327.c` to prevent potential buffer overflows. Also precalculated `name_len` to avoid calling `strlen` twice and prevent TOCTOU races between allocation and copying.

Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>

Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>
Replaced `strcpy` with `strscpy` in `target/linux/generic/files/drivers/net/phy/ar8327.c` to prevent potential buffer overflows. Also precalculated `name_len` to avoid calling `strlen` twice and prevent TOCTOU races between allocation and copying.

Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>

Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>
Replaced `strcpy` with `strscpy` in `target/linux/generic/files/drivers/net/phy/ar8327.c` to prevent potential buffer overflows. Also precalculated `name_len` to avoid calling `strlen` twice and prevent TOCTOU races between allocation and copying.

Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>

Co-authored-by: manupawickramasinghe <73810867+manupawickramasinghe@users.noreply.github.com>
@ManupaKDU ManupaKDU merged commit aea4438 into main May 22, 2026
174 of 176 checks passed
@ManupaKDU ManupaKDU deleted the sentinel-ar8327-strscpy-3457645063388007658 branch May 22, 2026 16:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant