linux-kernel - Re: [PATCH 18/18] cpupower: change strncpy+truncation to strlcpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Aug 2018 21:27:28 +0200
From:   Dominique Martinet <asmadeus@...ewreck.org>
To:     Daniel Díaz <daniel.diaz@...aro.org>
Cc:     Thomas Renninger <trenn@...e.com>, Shuah Khan <shuah@...nel.org>,
        Colin Ian King <colin.king@...onical.com>,
        linux-pm@...r.kernel.org, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 18/18] cpupower: change strncpy+truncation to strlcpy

Daniel Díaz wrote on Tue, Aug 14, 2018:
> I can't get cpupower to compile anymore now that it made its way to linux-next:
>   [/linux/tools/power/cpupower]$ make
>     CC       lib/cpufreq.o
>   [...]
>   make[1]: Entering directory '/linux/tools/power/cpupower/bench'
>     CC       main.o
>     CC       parse.o
>   parse.c: In function ‘prepare_config’:
>   parse.c:224:4: warning: implicit declaration of function ‘strlcpy’
> [-Wimplicit-function-declaration]
>       strlcpy(config->governor, val,
>       ^
>     CC       system.o
>     CC       benchmark.o
>     CC       cpufreq-bench
>   .//parse.o: In function `prepare_config':
>   /linux/tools/power/cpupower/bench/parse.c:224: undefined reference
> to `strlcpy'
>   collect2: error: ld returned 1 exit status
>   Makefile:25: recipe for target 'cpufreq-bench' failed
>   make[1]: *** [cpufreq-bench] Error 1
>   make[1]: Leaving directory '/linux/tools/power/cpupower/bench'
>   Makefile:258: recipe for target 'compile-bench' failed
>   make: *** [compile-bench] Error 2
> 
> Does it need anything special to make?

Ugh, no, I am really ashamed about this patch series for insufficient
testing in general. It is currently "under rework" for an indefinite
time frame as I have had other priorities but I'll add cpupower to the
list...
More precisely, the function is defined in the linux kernel but for
userspace strlcpy is only available through libbsd, and I don't believe
we should pull that in just for this.

I'll send a second patch using snprintf and warning if a truncation
occurs (which is the proper fix that the gcc folks intended people to do
anyway) when I get around to it, but I would recommend to just revert
the patch for now.

Shuah, could you take the patch off please if you haven't pushed it to
linus yet?

Sorry for the time you might have spent on this,
-- 
Dominique Martinet