We can remove strncpy() from the Linux kernel finally!

[kees@hachyderm.io]

We can remove strncpy() from the Linux kernel finally! I did the last 6 instances, and dropped all the implementations:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=dev/v7.0-rc2/strncpy

Over the last 6 years working on this, there were 362 commits by 70 contributors. The folks with more than 1 commit were:

211 Justin Stitt <justinstitt@google.com>
22 Xu Panda <xu.panda@zte.com.cn>
21 Kees Cook <kees@kernel.org>
17 Thorsten Blum <thorsten.blum@linux.dev>
12 Arnd Bergmann <arnd@arndb.de>
4 Pranav Tyagi <pranav.tyagi03@gmail.com>
4 Lee Jones <lee@kernel.org>
2 Steven Rostedt <rostedt@goodmis.org>
2 Sam Ravnborg <sam@ravnborg.org>
2 Marcelo Moreira <marcelomoreira1905@gmail.com>
2 Krzysztof Kozlowski <krzk@kernel.org>
2 Kalle Valo <kvalo@kernel.org>
2 Jaroslav Kysela <perex@perex.cz>
2 Daniel Thompson <danielt@kernel.org>
2 Andrew Lunn <andrew@lunn.ch>

Thank you to all of you! (And especially to Justin Stitt who took on the brunt of the work.)

[artlog@agora.l0g.eu]

@kees

That's very recent, those last commits are less than one hour ago !

To get the juice of it could you quickly give context ?

Why removing strncpy() from kernel is great ?

What are good practices in kernel when dealing with strings ? ie What does replace strncpy in kernel ?

[raymaccarthy@mastodon.ie]

@kees
Great work, though it should never have been used in the first place.

[jdb@birdon.social]

@kees
Hi, though I have been using linux for decades, I don't know what it means.
Looks like strncopy() had lots of adherence in many place, but can you explain ?
Thank you.

[ausm@mastodon.social]

@jdb @kees
deprecated.rst ->
strncpy() did not guarantee NUL-termination of the destination buffer, leading to linear read overflows and other misbehavior. It also unconditionally NUL-padded the destination, which was a needless performance penalty for callers using only NUL-terminated strings. Due to its various behaviors, it was an ambiguous API for determining what an author's true intent was for the copy.

[ausm@mastodon.social]

@jdb
The replacements for strncpy() are:
- strscpy() when the destination must be NUL-terminated.
- strscpy_pad() when the destination must be NUL-terminated and
zero-padded (e.g., structs crossing privilege boundaries).
- memtostr() for NUL-terminated destinations from non-NUL-terminated
fixed-width sources (with the `__nonstring` attribute on the source).
- memtostr_pad() for the same, but with zero-padding.
1/2

[ausm@mastodon.social]

@jdb
- strtomem() for non-NUL-terminated fixed-width destinations, with
the `__nonstring` attribute on the destination.
- strtomem_pad() for non-NUL-terminated destinations that also need
zero-padding.
- memcpy_and_pad() for bounded copies from potentially unterminated
sources where the destination size is a runtime value.
2/2

[blu@tooot.im]

@artlog
https://github.com/KSPP/linux/issues/90
@kees