linux-hardening - Re: [PATCH] orangefs: cleanup uses of strncpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 3 Apr 2024 09:14:56 -0400
From: Mike Marshall <hubcap@...ibond.com>
To: Christian Brauner <brauner@...nel.org>
Cc: Martin Brandenburg <martin@...ibond.com>, Justin Stitt <justinstitt@...gle.com>, 
	devel@...ts.orangefs.org, linux-kernel@...r.kernel.org, 
	linux-hardening@...r.kernel.org, Arnd Bergmann <arnd@...db.de>, 
	Mike Marshall <hubcap@...ibond.com>
Subject: Re: [PATCH] orangefs: cleanup uses of strncpy

Hi...

I b4'd this patch (I love b4) and applied it to 6.9.0-rc2
and ran it through xfstests with no regressions, so please
add a tested-by for hubcap@...ibond.com.

Thanks...

-Mike Marshall

On Mon, Apr 1, 2024 at 4:53 AM Christian Brauner <brauner@...nel.org> wrote:
>
> On Fri, 22 Mar 2024 21:41:18 +0000, Justin Stitt wrote:
> > strncpy() is deprecated for use on NUL-terminated destination strings
> > [1] and as such we should prefer more robust and less ambiguous string
> > interfaces.
> >
> > There is some care taken to ensure these destination buffers are
> > NUL-terminated by bounding the strncpy()'s by ORANGEFS_NAME_MAX - 1 or
> > ORANGEFS_MAX_SERVER_ADDR_LEN - 1. Instead, we can use the new 2-argument
> > version of strscpy() to guarantee NUL-termination on the destination
> > buffers while simplifying the code.
> >
> > [...]
>
> If this needs to go separately from the vfs trees let me know.
>
> ---
>
> Applied to the vfs.misc branch of the vfs/vfs.git tree.
> Patches in the vfs.misc branch should appear in linux-next soon.
>
> Please report any outstanding bugs that were missed during review in a
> new review to the original patch series allowing us to drop it.
>
> It's encouraged to provide Acked-bys and Reviewed-bys even though the
> patch has now been applied. If possible patch trailers will be updated.
>
> Note that commit hashes shown below are subject to change due to rebase,
> trailer updates or similar. If in doubt, please check the listed branch.
>
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
> branch: vfs.misc
>
> [1/1] orangefs: cleanup uses of strncpy
>       https://git.kernel.org/vfs/vfs/c/fc10fed37526