# \[PATCH 00/20\] Manual replacement of all strlcpy in favor of strscpy - Subsystems: CRYPTO API, CONTROL GROUP (CGROUP), DMA BUFFER SHARING FRAMEWORK, DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS, Extended Verification Module (EVM), FILESYSTEMS (VFS and infrastructure), HARDWARE MONITORING, INTEGRITY MEASUREMENT ARCHITECTURE (IMA), KERNEL NFSD, SUNRPC, AND LOCKD SERVERS, KERNFS, LIBRARY CODE, M68K ARCHITECTURE, NETWORKING \[GENERAL\], NFS, SUNRPC, AND LOCKD CLIENTS, S390 ARCHITECTURE, S390 ZFCP DRIVER, SCSI TARGET SUBSYSTEM, SECURITY SUBSYSTEM, SOUND, THE REST, TRACING, TTY LAYER AND SERIAL DRIVERS, USB GADGET/PERIPHERAL SUBSYSTEM, USB OVER IP DRIVER, USB SUBSYSTEM, WATCHDOG DEVICE DRIVERS - Maintainers: Herbert Xu, "David S. Miller", Tejun Heo, Johannes Weiner, Michal Koutný, Sumit Semwal, Christian König, Philipp Stanner, Greg Kroah-Hartman, "Rafael J. Wysocki", Danilo Krummrich, Johan Hovold, Mimi Zohar, Roberto Sassu, Alexander Viro, Christian Brauner, Guenter Roeck, Dmitry Kasatkin, Chuck Lever, Jeff Layton, Andrew Morton, Geert Uytterhoeven, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Trond Myklebust, Anna Schumaker, Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Nihar Panda, "Martin K. Petersen", Paul Moore, James Morris, "Serge E. Hallyn", Jaroslav Kysela, Takashi Iwai, Linus Torvalds, Steven Rostedt, Masami Hiramatsu, Jiri Slaby, Neill Kapron, Valentina Manea, Shuah Khan, Shuah Khan, Wim Van Sebroeck - Series: 20 patches touching 23 files, +128/-118 - List: linux-crypto - 4 messages, 3 authors - Page: https://ratatoskr.run/linux-crypto/2021/02/6275721/t ## \[PATCH 00/20\] Manual replacement of all strlcpy in favor of strscpy - From: Romain Perier \ - Date: 2021-02-22 15:14:06 - Message: https://ratatoskr.run/linux-crypto/2021/02/6275721.md ```text strlcpy() copy a C-String into a sized buffer, the result is always a valid NULL-terminated that fits in the buffer, howerver it has severals issues. It reads the source buffer first, which is dangerous if it is non NULL-terminated or if the corresponding buffer is unbounded. Its safe replacement is strscpy(), as suggested in the deprecated interface [1]. We plan to make this contribution in two steps: - Firsly all cases of strlcpy's return value are manually replaced by the corresponding calls of strscpy() with the new handling of the return value (as the return code is different in case of error). - Then all other cases are automatically replaced by using coccinelle. This series covers manual replacements. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy Romain Perier (20): cgroup: Manual replacement of the deprecated strlcpy() with return values crypto: Manual replacement of the deprecated strlcpy() with return values devlink: Manual replacement of the deprecated strlcpy() with return values dma-buf: Manual replacement of the deprecated strlcpy() with return values kobject: Manual replacement of the deprecated strlcpy() with return values ima: Manual replacement of the deprecated strlcpy() with return values SUNRPC: Manual replacement of the deprecated strlcpy() with return values kernfs: Manual replacement of the deprecated strlcpy() with return values m68k/atari: Manual replacement of the deprecated strlcpy() with return values module: Manual replacement of the deprecated strlcpy() with return values hwmon: Manual replacement of the deprecated strlcpy() with return values s390/hmcdrv: Manual replacement of the deprecated strlcpy() with return values scsi: zfcp: Manual replacement of the deprecated strlcpy() with return values target: Manual replacement of the deprecated strlcpy() with return values ALSA: usb-audio: Manual replacement of the deprecated strlcpy() with return values tracing/probe: Manual replacement of the deprecated strlcpy() with return values vt: Manual replacement of the deprecated strlcpy() with return values usb: gadget: f_midi: Manual replacement of the deprecated strlcpy() with return values usbip: usbip_host: Manual replacement of the deprecated strlcpy() with return values s390/watchdog: Manual replacement of the deprecated strlcpy() with return values arch/m68k/emu/natfeat.c | 6 +-- crypto/lrw.c | 6 +-- crypto/xts.c | 6 +-- drivers/dma-buf/dma-buf.c | 4 +- drivers/hwmon/pmbus/max20730.c | 66 +++++++++++++------------ drivers/s390/char/diag_ftp.c | 4 +- drivers/s390/char/sclp_ftp.c | 6 +-- drivers/s390/scsi/zfcp_fc.c | 8 +-- drivers/target/target_core_configfs.c | 33 ++++--------- drivers/tty/vt/keyboard.c | 5 +- drivers/usb/gadget/function/f_midi.c | 4 +- drivers/usb/gadget/function/f_printer.c | 8 +-- drivers/usb/usbip/stub_main.c | 6 +-- drivers/watchdog/diag288_wdt.c | 12 +++-- fs/kernfs/dir.c | 27 +++++----- kernel/cgroup/cgroup.c | 2 +- kernel/module.c | 4 +- kernel/trace/trace_uprobe.c | 11 ++--- lib/kobject_uevent.c | 6 +-- net/core/devlink.c | 6 +-- net/sunrpc/clnt.c | 6 ++- security/integrity/ima/ima_policy.c | 8 ++- sound/usb/card.c | 4 +- 23 files changed, 129 insertions(+), 119 deletions(-) -- 2.20.1 ``` ## \[PATCH 02/20\] crypto: Manual replacement of the deprecated strlcpy() with return values - From: Romain Perier \ - Date: 2021-02-22 15:15:25 - Message: https://ratatoskr.run/linux-crypto/2021/02/6275723.md ```text The strlcpy() reads the entire source buffer first, it is dangerous if the source buffer lenght is unbounded or possibility non NULL-terminated. It can lead to linear read overflows, crashes, etc... As recommended in the deprecated interfaces [1], it should be replaced by strscpy. This commit replaces all calls to strlcpy that handle the return values by the corresponding strscpy calls with new handling of the return values (as it is quite different between the two functions). [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy Signed-off-by: Romain Perier --- crypto/lrw.c | 6 +++--- crypto/xts.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/crypto/lrw.c b/crypto/lrw.c index bcf09fbc750a..4d35f4439012 100644 --- a/crypto/lrw.c +++ b/crypto/lrw.c @@ -357,10 +357,10 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb) * cipher name. */ if (!strncmp(cipher_name, "ecb(", 4)) { - unsigned len; + ssize_t len; - len = strlcpy(ecb_name, cipher_name + 4, sizeof(ecb_name)); - if (len < 2 || len >= sizeof(ecb_name)) + len = strscpy(ecb_name, cipher_name + 4, sizeof(ecb_name)); + if (len == -E2BIG || len < 2) goto err_free_inst; if (ecb_name[len - 1] != ')') diff --git a/crypto/xts.c b/crypto/xts.c index 6c12f30dbdd6..1dfe39d61418 100644 --- a/crypto/xts.c +++ b/crypto/xts.c @@ -396,10 +396,10 @@ static int xts_create(struct crypto_template *tmpl, struct rtattr **tb) * cipher name. */ if (!strncmp(cipher_name, "ecb(", 4)) { - unsigned len; + ssize_t len; - len = strlcpy(ctx->name, cipher_name + 4, sizeof(ctx->name)); - if (len < 2 || len >= sizeof(ctx->name)) + len = strscpy(ctx->name, cipher_name + 4, sizeof(ctx->name)); + if (len == -E2BIG || len < 2) goto err_free_inst; if (ctx->name[len - 1] != ')') ``` ## Re: \[PATCH 00/20\] Manual replacement of all strlcpy in favor of strscpy - From: Shuah Khan \ - Date: 2021-02-22 16:38:07 - Message: https://ratatoskr.run/linux-crypto/2021/02/6275837.md ```text On 2/22/21 8:12 AM, Romain Perier wrote: > strlcpy() copy a C-String into a sized buffer, the result is always a > valid NULL-terminated that fits in the buffer, howerver it has severals > issues. It reads the source buffer first, which is dangerous if it is non > NULL-terminated or if the corresponding buffer is unbounded. Its safe > replacement is strscpy(), as suggested in the deprecated interface [1]. > > We plan to make this contribution in two steps: > - Firsly all cases of strlcpy's return value are manually replaced by the > corresponding calls of strscpy() with the new handling of the return > value (as the return code is different in case of error). > - Then all other cases are automatically replaced by using coccinelle. > Cool. A quick check shows me 1031 strscpy() calls with no return checks. All or some of these probably need to be reviewed and add return checks. Is this something that is in the plan to address as part of this work? thanks, -- Shuah ``` ## Re: \[PATCH 02/20\] crypto: Manual replacement of the deprecated strlcpy() with return values - From: Herbert Xu \ - Date: 2021-03-04 04:39:04 - Message: https://ratatoskr.run/linux-crypto/2021/03/6287747.md ```text On Mon, Feb 22, 2021 at 04:12:13PM +0100, Romain Perier wrote: > > diff --git a/crypto/lrw.c b/crypto/lrw.c > index bcf09fbc750a..4d35f4439012 100644 > --- a/crypto/lrw.c > +++ b/crypto/lrw.c > @@ -357,10 +357,10 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb) > * cipher name. > */ > if (!strncmp(cipher_name, "ecb(", 4)) { > - unsigned len; > + ssize_t len; > > - len = strlcpy(ecb_name, cipher_name + 4, sizeof(ecb_name)); > - if (len < 2 || len >= sizeof(ecb_name)) > + len = strscpy(ecb_name, cipher_name + 4, sizeof(ecb_name)); > + if (len == -E2BIG || len < 2) len == -E2BIG is superfluous as len < 2 will catch it anyway. Thanks, -- Email: Herbert Xu [ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ```