From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11A8CC433E1 for ; Thu, 27 Aug 2020 18:30:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E4F822080C for ; Thu, 27 Aug 2020 18:30:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="kxRn8GVt" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727017AbgH0Sav (ORCPT ); Thu, 27 Aug 2020 14:30:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726291AbgH0Sau (ORCPT ); Thu, 27 Aug 2020 14:30:50 -0400 Received: from mail-pj1-x1041.google.com (mail-pj1-x1041.google.com [IPv6:2607:f8b0:4864:20::1041]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2DE8C06121B for ; Thu, 27 Aug 2020 11:30:50 -0700 (PDT) Received: by mail-pj1-x1041.google.com with SMTP id mw10so3039864pjb.2 for ; Thu, 27 Aug 2020 11:30:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=3fcEiNsK377lJ2U8rpSs38iDBS2ZV98GwCjqRo1vxUY=; b=kxRn8GVthzhJNiLIz156XdWb3wvc3qTHVG9KcCKr+IO7FagquqdJ1dWSYNWNdmt0Vf p+fSBDp8sDifTZp1vPQDf2PNCSKwwftZSz0EfVY8VBi13qDFdgWXoHCLtGslwTzzIVmO iJJxRN4WrxzQChuKCzRqiBoaJ0EcTbYK/N9VM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=3fcEiNsK377lJ2U8rpSs38iDBS2ZV98GwCjqRo1vxUY=; b=q2TLju1PGFjFXY3R4Ve/SidA0RKaY1UXHjchX9v51sqauJo68M5JYLWgiUstjiOSrf D1ky7PO5r5CNQmR3Ydtus41qSPxi/WvOUr8LHU3nwbXXaQYZQ1acodbDfMR3Hx5Q2HYh eAgJ2Pj4M2mSWT1PBjdP+lNMsVFPg85Ct+nwfIeMgZN2v+4XXEnFda4Kkx1TCiXqj9BJ aXVJnpE02gH7xhLL7LPWwRje1ER9WpXnb5NpaWku3fANwn1/M10YMrcgRwrbAqWvMs5x Pb9CdS7EOy6ez1bZ/Tvr7dXMsQvVM0tR54bn0DQoz3jGneZe1nUQvdAeVH/zU+GwwVws Os+Q== X-Gm-Message-State: AOAM530ZK4fvrnz8nVyzrzn4r/F2U0ah1M032CvJUiV9iEde4dwzH8bp scH8KCv5jJDeCaiQZYXVXEFo5A== X-Google-Smtp-Source: ABdhPJxKzsjx666MA955Hh/7QaQiVKOQT26Dg2evOJ5w+/mVexkWKFYPBarCeIf40FclUKYXIp0zDg== X-Received: by 2002:a17:90a:c704:: with SMTP id o4mr150099pjt.146.1598553050196; Thu, 27 Aug 2020 11:30:50 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id k5sm3139734pgk.78.2020.08.27.11.30.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2020 11:30:48 -0700 (PDT) Date: Thu, 27 Aug 2020 11:30:48 -0700 From: Kees Cook To: Andy Shevchenko Cc: Masahiro Yamada , Nick Desaulniers , Joe Perches , clang-built-linux , stable , Andy Lavr , Arvind Sankar , Rasmus Villemoes , Sami Tolvanen , Andrew Morton , Andy Shevchenko , Alexandru Ardelean , Yury Norov , Linux Kernel Mailing List Subject: Re: [PATCH v3] lib/string.c: implement stpcpy Message-ID: <202008271126.2C397BF6D@keescook> References: <20200825135838.2938771-1-ndesaulniers@google.com> <202008261627.7B2B02A@keescook> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Thu, Aug 27, 2020 at 11:59:24AM +0300, Andy Shevchenko wrote: > strcpy() is not a bad API for the cases when you know what you are > doing. A problem that most of the developers do not know what they are > doing. > No need to split everything to bad and good by its name or semantics, > each API has its own pros and cons and programmers must use their > brains. I equate "unsafe" or "fragile" with "bad". There's no reason to use our brains for remembering what's safe or not when we can just remove unsafe things from the available APIs, and/or lean on the compiler to help (e.g. CONFIG_FORTIFY_SOURCE). Most of the uses of strcpy() in the kernel are just copying between two known-at-compile-time NUL-terminated character arrays. We had wanted to introduce stracpy() for this, but Linus objected to yet more string functions. So for now, I'm aimed at removing strlcpy() completely first, then look at strcpy() -> strscpy() for cases where target size is NOT compile-time known, and then to convert the kernel's strcpy() into _requiring_ that source/dest lengths are known at compile time. And then tackle strncpy(), which is a mess. -- Kees Cook