linux-kernel - Re: [PATCH] libbpf: Replace strcpy() with memcpy() in bpf_object_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAO9wTFioFna7r_qxfWNQasAYC6rodkqP+1GdYJKSQEFKg-xXtg@mail.gmail.com>
Date: Thu, 17 Jul 2025 22:50:34 +0530
From: Suchit K <suchitkarunakaran@...il.com>
To: Greg KH <gregkh@...uxfoundation.org>
Cc: Yonghong Song <yonghong.song@...ux.dev>, ast@...nel.org, daniel@...earbox.net, 
	andrii@...nel.org, martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org, 
	john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me, 
	haoluo@...gle.com, jolsa@...nel.org, bpf@...r.kernel.org, 
	skhan@...uxfoundation.org, linux-kernel-mentees@...ts.linux.dev, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] libbpf: Replace strcpy() with memcpy() in bpf_object__new()

> Your change also did not do any bounds checking at all, so how is this
> now safer?
>
> confused,
>
> greg k-h

I assumed bounds checking wasn't necessary here because obj is
allocated at the start of the function with enough space
(sizeof(struct bpf_object) + strlen(path) + 1). My main motivation for
the change was the deprecation of strcpy(). However, thinking about it
now, I'm not entirely sure memcpy is even needed in this context. I'd
really appreciate any feedback or clarification on the best approach
here.