linux-hardening - Re: [PATCH] ACPI / sysfs: Replace deprecated strcpy() with sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0gHpaAs9DtP7z1NoBPVEF0FQjBXEyRWoUTWhRCLF80Ajw@mail.gmail.com>
Date: Wed, 2 Jul 2025 20:04:05 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Brahmajit Das <listout@...tout.xyz>
Cc: linux-hardening@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-acpi@...r.kernel.org, rafael@...nel.org, lenb@...nel.org, 
	lv.zheng@...el.com, kees@...nel.org, rui.zhang@...el.com, len.brown@...el.com
Subject: Re: [PATCH] ACPI / sysfs: Replace deprecated strcpy() with sysfs_emit

On Tue, Jun 24, 2025 at 4:21 PM Brahmajit Das <listout@...tout.xyz> wrote:
>
> strcpy() is deprecated; use sysfs_emit() instead. No functional changes
> intended.

It may be deprecated, but is it used incorrectly in this particular case?

> Link: https://github.com/KSPP/linux/issues/88
> Signed-off-by: Brahmajit Das <listout@...tout.xyz>
> ---
>  drivers/acpi/sysfs.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
> index a48ebbf768f9..7ce90998ab97 100644
> --- a/drivers/acpi/sysfs.c
> +++ b/drivers/acpi/sysfs.c
> @@ -181,10 +181,9 @@ static int param_set_trace_method_name(const char *val,
>
>         /* This is a hack.  We can't kmalloc in early boot. */
>         if (is_abs_path)
> -               strcpy(trace_method_name, val);
> +               sysfs_emit(trace_method_name, "%s", val);
>         else {
> -               trace_method_name[0] = '\\';
> -               strcpy(trace_method_name+1, val);
> +               sysfs_emit(trace_method_name, "\%s", val);
>         }

The code does strlen() checks before this, I don't think that the
change is an improvement.

>
>         /* Restore the original tracer state */
> --