linux-hardening - Re: [PATCH RESEND] alpha: Replace strcpy() with strscpy() in setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <99A381BA-47F7-410E-AC3C-D6EFA298DD5A@linux.dev>
Date: Mon, 8 Sep 2025 15:23:40 +0200
From: Thorsten Blum <thorsten.blum@...ux.dev>
To: Magnus Lindholm <linmag7@...il.com>
Cc: Richard Henderson <richard.henderson@...aro.org>,
 Matt Turner <mattst88@...il.com>,
 linux-hardening@...r.kernel.org,
 linux-alpha@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND] alpha: Replace strcpy() with strscpy() in
 setup_arch()

Hi Magnus,

On 30. Aug 2025, at 21:11, Magnus Lindholm wrote:
> It can be a bit controversial to replace the platform specific string
> manipulation functions with a generic interface. On Alpha, there is nothing
> (at least to my knowledge) that indicates that strcpy is broken or used in
> an unsafe way and hence this patch doesn't really fix anything.
> In my opinion, I think this should be a NAK.

My patch doesn't fix anything, it simply replaces the deprecated
strcpy() with the safer strscpy(), without introducing any functional
changes.

I'm not sure whether the platform-specific strcpy() has any performance
benefits over the generic strscpy(), but setup_arch() is already using
strscpy() (converted from strlcpy() [1]) to copy the COMMAND_LINE string
to 'command_line'.

The current code feels unnecessarily inconsistent, with one line using
strscpy() and the next using the platform-specific strcpy().

Thanks,
Thorsten

[1] https://lore.kernel.org/all/20220818205936.6144-1-wsa+renesas@sang-engineering.com/