Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] API replacement/deprecation

[Kees Cook <keescook@chromium.org>]

On Mon, Sep 10, 2018 at 5:28 AM, Mauro Carvalho Chehab
<mchehab+samsung@kernel.org> wrote:
> Em Thu, 6 Sep 2018 16:24:03 -0700
> Kees Cook <keescook@chromium.org> escreveu:
>
>> On Thu, Sep 6, 2018 at 4:18 PM, Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>> > Hi Kees,
>> >
>> > On Thu, 6 Sep 2018 11:24:11 -0700 Kees Cook <keescook@chromium.org> wrote:
>> >>
>> >> If there was an agreement by all maintainers that deprecated
>> >> functions/patterns should not be added, and we documented the
>> >> deprecation somewhere like Documentation/process/deprecated.rst, then
>> >> we could make the declaration that if such functions got added (it's
>> >> easy to mechanically check for them), it would be the responsibility
>> >> of the author and maintainer chain to see that it got fixed before the
>> >> release is cut. We already have this for things like "breaks the x86
>> >> allmodconfig build" or similar. The checking would be manual, and the
>> >> enforcement would be by agreement, but it'd be better than the kind of
>> >> "please don't do this" hand-waving we've had in the past.
>> >
>> > I could do this in linux-next, of course, the same way I check for
>> > missing signed-off-bys.  All I would need is the list of deprecated
>> > things.
>>
>> Hopefully we can all agree on deprecating strcpy() and strncpy() in
>> favor of strscpy()?
>
> I suspect that that's the way to go for most use cases.
>
> In the case of media, I double-checked: 100% of the usages can be
> replaced by strscpy() [1]. I just sent a patchset for review with
> such changes.

Double-check the strncpy() uses: some may depend on the trailing NUL-padding.

> Yet, there are 104 occurrences of strncpy_from_user(). If they
> all do something similar, it could make sense to have a
> strscpy_from_user() function. If you're willing to do so,
> feel free to also convert av7110 to it.

Yeah. I think we need:

strscpy_pad()
memcpy_pad()
strscpy_from_user()

The strncpy uses are:

1- safer strcpy() (usually visible with leading/trailing "buf[size-1]=0")
2- padded strcpy() (to wipe the contents of a destination)
3- copy non-NUL-terminated array of characters

1 should use strscpy
2 needs a strscpy+trailing memset (e.g. strscpy_pad())
3 needs memcpy+trailing memset (e.g. memcpy_pad())

I suggest "memcpy_pad" to very clearly distinguish that it is not
NUL-terminated, but rather NUL-padded.

-Kees

-- 
Kees Cook
Pixel Security