Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.600.7\))
Subject: Re: [PATCH] RISC-V: cpu: refactor deprecated strncpy
From:   Jessica Clarke <jrtc27@jrtc27.com>
In-Reply-To: <20230801-arch-riscv-kernel-v1-1-2b3f2dc0bc61@google.com>
Date:   Wed, 2 Aug 2023 00:02:11 +0100
Cc:     Paul Walmsley <paul.walmsley@sifive.com>,
        Palmer Dabbelt <palmer@dabbelt.com>,
        Albert Ou <aou@eecs.berkeley.edu>,
        linux-riscv <linux-riscv@lists.infradead.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Nick Desaulniers <ndesaulniers@google.com>,
        linux-hardening@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <61DD603A-3D86-462F-B795-7EDE3A59ABBE@jrtc27.com>
References: <20230801-arch-riscv-kernel-v1-1-2b3f2dc0bc61@google.com>
To:     Justin Stitt <justinstitt@google.com>
Precedence: bulk

On 1 Aug 2023, at 22:14, Justin Stitt <justinstitt@google.com> wrote:
>=20
> `strncpy` is deprecated for use on NUL-terminated destination strings =
[1].
>=20
> A suitable replacement is `strscpy` [2] due to the fact that it
> guarantees NUL-termination on its destination buffer argument which is
> _not_ the case for `strncpy`!
>=20
> The `sv_type` buffer is declared with a size of 16 which is then
> followed by some `strncpy` calls to populate the buffer with one of:
> "sv32", "sv57", "sv48", "sv39" or "none". Hard-coding the max length =
as 5 is
> error-prone and involves counting the number of characters (and
> hopefully not forgetting to count the NUL-byte) in the raw string.
>=20
> Using a pre-determined max length in combination with `strscpy` =
provides
> a cleaner, less error-prone as well as a less ambiguous =
implementation.
> `strscpy` guarantees that it's destination buffer is NUL-terminated =
even
> if it's source argument exceeds the max length as defined by the third
> argument.

I would imagine you=E2=80=99d want a BUG_ON() rather than silent =
truncation if
that ever happened (well, silent if you ignore it then printing the
truncated string).

Though really you just want a static_strcpy that looks at sizeof* for
source and destination and fails to build if it doesn=E2=80=99t fit; =
there=E2=80=99s no
reason this needs to be found at run time.

(* and __builtin_types_compatible_p(char[], ...))

Jess