From: David Laight <David.Laight@ACULAB.COM>
To: 'Joe Perches' <joe@perches.com>, Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>,
Dwaipayan Ray <dwaipayanray1@gmail.com>,
linux-kernel <linux-kernel@vger.kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
"linux-kernel-mentees@lists.linuxfoundation.org"
<linux-kernel-mentees@lists.linuxfoundation.org>
Subject: Re: [Linux-kernel-mentees] deprecated.rst: deprecated strcpy ? (was: [PATCH] checkpatch: add a new check for strcpy/strlcpy uses)
Date: Fri, 8 Jan 2021 10:05:52 +0000 [thread overview]
Message-ID: <05733c9670a14463bec36b2cf0eeeede@AcuMS.aculab.com> (raw)
In-Reply-To: <9e111f0f673ae6ced12efc01d32eefe8402c7f72.camel@perches.com>
From: Joe Perches
> Sent: 08 January 2021 00:52
...
> > The original goal was to use another helper that worked on static
> > strings like this. Linus rejected that idea, so we're in a weird place.
> > I think we could perhaps build a strcpy() replacement that requires
> > compile-time validated arguments, and to break the build if not.
> >
> > i.e.
> >
> > given:
> > char array[8];
> > char *ptr;
> >
> > allow:
> >
> >
> > strcpy(array, "1234567");
> >
> > disallow:
> >
> > strcpy(array, "12345678"); /* too long */
> > strcpy(array, src); /* not optimized, so use strscpy? */
> > strcpy(ptr, "1234567"); /* unknown destination size */
> > strcpy(ptr, src); /* unknown destination size */
>
> I think that's not a good idea as it's not a generic equivalent of the
> string.h code.
>
> I still like the stracpy variant I proposed:
>
> https://lore.kernel.org/lkml/24bb53c57767c1c2a8f266c305a670f7@sk2.org/T/#m0627aa770a076af1937cb5c610ed
> 71dab3f1da72
> https://lore.kernel.org/lkml/CAHk-=wgqQKoAnhmhGE-2PBFt7oQs9LLAATKbYa573UO=DPBE0Q@mail.gmail.com/
>
> Linus liked a variant he called copy_string:
>
> https://lore.kernel.org/lkml/CAHk-=wg8vLmmwTGhXM51NpSWJW8RFEAKoXxG0Hu_Q9Uwbjj8kw@mail.gmail.com/
>
> I think the cocci scripts that convert:
>
> strlcpy -> strscpy (only when return value unused)
> str<sln>cpy(array, "string") -> stracpy(foo, "string")
> s[cn]printf -> sysfs_emit
>
> would leave relatively few uses of strcpy and sprintf variants and would
> make it much easier to analyze the remainder uses for potential overflows.
The advantage of allowing strcpy() but only when the when it can be
converted into a non-overflowing memcpy() is that you know that the
copies never get truncated.
The next round of string copy errors could easily by the 'silent truncation'
ones - so using such a strcpy() will cut down the next audit.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
next prev parent reply other threads:[~2021-01-08 10:06 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-05 8:23 [Linux-kernel-mentees] [PATCH] checkpatch: add a new check for strcpy/strlcpy uses Dwaipayan Ray
2021-01-05 8:44 ` Joe Perches
2021-01-05 8:59 ` Dwaipayan Ray
2021-01-05 9:28 ` [Linux-kernel-mentees] deprecated.rst: deprecated strcpy ? (was: [PATCH] checkpatch: add a new check for strcpy/strlcpy uses) Joe Perches
2021-01-07 21:16 ` Kees Cook
2021-01-08 0:51 ` Joe Perches
2021-01-08 10:05 ` David Laight [this message]
2021-01-08 19:48 ` Kees Cook
2021-01-05 10:20 ` [Linux-kernel-mentees] [PATCH] checkpatch: add a new check for strcpy/strlcpy uses David Laight
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=05733c9670a14463bec36b2cf0eeeede@AcuMS.aculab.com \
--to=david.laight@aculab.com \
--cc=corbet@lwn.net \
--cc=dwaipayanray1@gmail.com \
--cc=joe@perches.com \
--cc=keescook@chromium.org \
--cc=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).