lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 12 Oct 2023 12:48:58 -0700
From: Jacob Keller <>
To: Justin Stitt <>, Jesse Brandeburg
	<>, Tony Nguyen <>,
	"David S. Miller" <>, Eric Dumazet <>,
	Jakub Kicinski <>, Paolo Abeni <>
CC: <>, <>,
	<>, <>
Subject: Re: [PATCH net-next 0/7] net: intel: replace deprecated strncpy uses

On 10/10/2023 3:26 PM, Justin Stitt wrote:
> Hi,
> This series aims to eliminate uses of strncpy() as it is a deprecated
> interface [1] with many viable replacements available.
> Predominantly, strscpy() is the go-to replacement as it guarantees
> NUL-termination on the destination buffer (which strncpy does not). With
> that being said, I did not identify any buffer overread problems as the
> size arguments were carefully measured to leave room for trailing
> NUL-bytes. Nonetheless, we should favor more robust and less ambiguous
> interfaces.
> Previously, each of these patches was sent individually at:
> 1)
> 2)
> 3)
> 4)
> 5)
> 6)
> 7)
> Consider these dead as this series is their new home :)
> I found all these instances with: $ rg "strncpy\("
> This series may collide in a not-so-nice way with [3]. This series can
> go in after that one with a rebase. I'll send a v2 if necessary.

I'm working to apply these to the Intel Wired LAN dev-queue now, and
I'll see how bad it is. I will ping you if I need a rebased version.


Powered by blists - more mailing lists