linux-hardening - Re: [PATCH RESEND] alpha: Replace strcpy() with strscpy() in setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CA+=Fv5QdP-qGjUXQZ4ig1RX=0zx5c11gdrvwT9gqXNqTTqSZvA@mail.gmail.com>
Date: Sat, 30 Aug 2025 21:11:29 +0200
From: Magnus Lindholm <linmag7@...il.com>
To: Thorsten Blum <thorsten.blum@...ux.dev>
Cc: Richard Henderson <richard.henderson@...aro.org>, Matt Turner <mattst88@...il.com>, 
	linux-hardening@...r.kernel.org, linux-alpha@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND] alpha: Replace strcpy() with strscpy() in setup_arch()

Hi,

It can be a bit controversial to replace the platform specific string
manipulation functions with a generic interface. On Alpha, there is nothing
(at least to my knowledge) that indicates that strcpy is broken or used in
an unsafe way and hence this patch doesn't really fix anything.
In my opinion, I think this should be a NAK.

Linus wrote some relevant stuff on this topic

Link:
https://github.com/torvalds/linux/commit/30c44659f4a3e7e1f9f47e895591b4b40bf62671

like for example:

"Use this in places where it makes sense, but don't do trivial patches
to fix things that aren't actually known to be broken."


Regards

Magnus Lindholm

On Mon, Aug 18, 2025 at 1:23 AM Thorsten Blum <thorsten.blum@...ux.dev> wrote:
>
> strcpy() is deprecated; use strscpy() instead.
>
> Since the destination buffer 'command_line' has a fixed length,
> strscpy() automatically determines its size using sizeof() when the size
> argument is omitted. This makes the explicit size argument for the
> existing strscpy() call unnecessary - remove it.
>
> No functional changes intended.
>
> Link: https://github.com/KSPP/linux/issues/88
> Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
> ---
>  arch/alpha/kernel/setup.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
> index bebdffafaee8..8b51e6ca83d6 100644
> --- a/arch/alpha/kernel/setup.c
> +++ b/arch/alpha/kernel/setup.c
> @@ -468,8 +468,8 @@ setup_arch(char **cmdline_p)
>         /*
>          * Locate the command line.
>          */
> -       strscpy(command_line, COMMAND_LINE, sizeof(command_line));
> -       strcpy(boot_command_line, command_line);
> +       strscpy(command_line, COMMAND_LINE);
> +       strscpy(boot_command_line, command_line, COMMAND_LINE_SIZE);
>         *cmdline_p = command_line;
>
>         /*
> @@ -511,7 +511,7 @@ setup_arch(char **cmdline_p)
>         }
>
>         /* Replace the command line, now that we've killed it with strsep.  */
> -       strcpy(command_line, boot_command_line);
> +       strscpy(command_line, boot_command_line);
>
>         /* If we want SRM console printk echoing early, do it now. */
>         if (alpha_using_srm && srmcons_output) {
> --
> 2.50.1
>
>