From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D15C3DDDA4 for ; Tue, 24 Mar 2026 09:22:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774344135; cv=none; b=gnTABZImMKF3dBQMXLkOAJdUl4w6ocy+/mRATjZk8QTVOiCxObJh0vVwbCwPDhzrcDzhfj/Yw0GvxTA1vNs30bsF6LMqviaafozHR4KMszyd+nZ/y8sEkmtkFZnXxw4MvTmBDFJgSvRC+TchUHYz1VobvEgtW0wkEsipdmqaloo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774344135; c=relaxed/simple; bh=sNLk76kfl7rLDqgYawYpkGGTBOF6YKCy2yhpNZuonuY=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Sqvony2RX6a5L0PfNli2UjXhG3C/4l9SMjDRm1yjtCkzqeAkPGZql9xP8ZxHkp9H41Dx6wSdMtcVPcUBhMYUMDKdSwGyf+6jv4yebJSHzmnx850fwm4nPaDsyF8BFXW6H6fCXvZowC5YwW6hU/8I9VescJ1m5TPN9l76ROcHeWw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=s3E72d1q; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="s3E72d1q" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-486fda2a389so29749585e9.1 for ; Tue, 24 Mar 2026 02:22:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1774344120; x=1774948920; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:from:to:cc:subject:date:message-id:reply-to; bh=1p/kuw5Gevu0gSvz//t6cWZ4W2ENzeaQpoHOrBzYASU=; b=s3E72d1qy9EYz8G6RaW9hvwTn+gPd5JBgYXiur75e6amwTuleO3X7aLSlCzBJwBbBF Dk3w2OvPXjvpPlpBmz612M/aQujZt73eH6qKTksjqouF/6em5vA90tPJZ8JfKGTUEDur j/rEx8+/Ikknez6rXAFPo1RR4yoFyqHI+rt3gcZ25OylRZ0ouDoX/+zbZIGsvx5UdkEt 3mjt2lS9JaLyDf9Wr81ZX7Njfdr/phY7utLuP57lzf6bgdwhphiEijfTCFIwSIq/qjHh XbUnGCgj+ZwEu2zauxV9ybdXkG486bHg/UKRO22ON1+MeAwYonOItZj4gY4KLyVCyRBi 6Rpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774344120; x=1774948920; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=1p/kuw5Gevu0gSvz//t6cWZ4W2ENzeaQpoHOrBzYASU=; b=ehmlsDoVJsj37M8Y7ag/PduII0KNh0ECQw0Jxx/zP1YRN22sQTE0b2knlXAc8NVPyy sEYJG544nq37RqzEFAQMv1Zdb4AueJZ1o061t5WChcxeEODeaOwokP4YjCUnVjqY90ox fjOKk2Na5hssZrTrG5+FgbRwUzq8ItD4Zxue7NjnQR0RhVM6w9KBA9S9fdNU6uGzYX6x uVNJb7wAscl4PIpEMUioVG+a0AVQuYTQ4aahUNzxACif5lIRrFZG1CnXmxC7/JEzQi0E sH3affpgCg4C7eY68r9f3hZKQJVUqy2L16z3wqvUO4qsgbA55VB0oy69fKfj3P8G/cIW dyfA== X-Forwarded-Encrypted: i=1; AJvYcCVPd1JZryYIhWMbVqJpFQ/YHOQLCWUhSTBdIgxyPETCoDz7uO2SWu/mbws63hBE4iKtuYr6eS0H9xrI+tU=@vger.kernel.org X-Gm-Message-State: AOJu0YxrXwK4lPC6L71kaOUsC6D3ye/u/PK6K/9RH9Z+3iNUl/OvS2Em L6+1ye+RcanttlToH/BrmtLSPUcJHUC8bgQ1zIwxA2SsSwJFvYVXEKz2 X-Gm-Gg: ATEYQzzFiPviAwmgUb7xdD9E86yTR3Mu9GQT4CAKsNBsWYvIChlRp/VXCb468rG0EWb eFHnGIgrLfZY8Vf6ETV5TREO6Lt94isUFMk49C5OZ2Fv/RgDtCa+s8k1IhO8+8cquh+Da+s/PzM wgm/TwKdo24udiXJlN6ZqSkXQEkoxETNYjxgvEKYtGsenBkJpd4r68B+EMtL1DVrvA3FdYBGnQG yPke7e5kc2SVqUWJujLObUxfkeSA63LZAHkmyCM81A55F1IoATfzlI82HtS8SalgtGVn7euWsVe ACIduvXLB+i/LC/y8NoljEBYQBCNJLpGzUqUkkkn29aQ73Rrvci3BBrOL5WDxyY3FTJ5lYlDd8n uyKd1GfVBUKVhbaLnLIjU0KCE6LBSbQZhzCmvESMrc/F7WfWlr4RTcaiPmTn3lBOO5ZkWmaOv1+ edyy5w4QE= X-Received: by 2002:a05:600c:5291:b0:485:34b3:8589 with SMTP id 5b1f17b1804b1-486ff04d42fmr222877075e9.31.1774344119927; Tue, 24 Mar 2026 02:21:59 -0700 (PDT) Received: from krava ([2a02:8308:a00c:e200::d99c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4870f6c094csm28734605e9.1.2026.03.24.02.21.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Mar 2026 02:21:59 -0700 (PDT) From: Jiri Olsa X-Google-Original-From: Jiri Olsa Date: Tue, 24 Mar 2026 10:21:58 +0100 To: Kees Cook Cc: Andrii Nakryiko , Eduard Zingerman , Alexei Starovoitov , Daniel Borkmann , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH v2] libbpf: Replace strncpy() with strnlen()+memcpy() in skel_map_create() Message-ID: References: <20260324053036.it.906-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260324053036.it.906-kees@kernel.org> On Mon, Mar 23, 2026 at 10:30:37PM -0700, Kees Cook wrote: > Replace the deprecated[1] strncpy() with strnlen() on the source > followed by memcpy(). Normally strscpy() would be used in this case, > but skel_internal.h is shared between kernel and userspace tools, and > strscpy() is not available in the userspace build context. > > The source map_name is a NUL-terminated C string (the only caller > passes a 12 character string literal). The destination attr.map_name is > char[BPF_OBJ_NAME_LEN] (16 bytes) in union bpf_attr, passed to the bpf() > syscall. The kernel's bpf_obj_name_cpy() requires a NUL terminator within > the 16-byte field, rejecting names that use all 16 bytes. Valid names > are therefore at most 15 characters. > > The attr is pre-zeroed with memset() at the top of the function, > so the byte at position 15 is always NUL. The copy is bounded to > sizeof(attr.map_name) - 1 (15 bytes) to guarantee NUL-termination is hm, but this version no longer does that, right? jirka > preserved. This is safe because the kernel would reject a 16-byte > unterminated name anyway, and the only in-tree caller passes > "__loader.map" (12 characters). > > While the original strncpy() would have copied a full 16 bytes from an > overlong name (producing an unterminated field that the syscall rejects), > but this shouldn't be a reachable state. Forcing truncation to 15 bytes, > however, seemed to induce a (unrelated?) BPF selftest failure: > https://github.com/kernel-patches/bpf/actions/runs/23472955268/job/68300440546 > > Allow the literal to exceed 15 characters and exactly reproduce the > original strncpy() behavior (potentially lacking a NUL termination). > > Link: https://github.com/KSPP/linux/issues/90 [1] > Signed-off-by: Kees Cook > --- > v2: don't force truncation > v1: https://lore.kernel.org/lkml/20260324040535.work.851-kees@kernel.org/ > Cc: Andrii Nakryiko > Cc: Eduard Zingerman > Cc: Alexei Starovoitov > Cc: Daniel Borkmann > Cc: Martin KaFai Lau > Cc: Song Liu > Cc: Yonghong Song > Cc: John Fastabend > Cc: KP Singh > Cc: Stanislav Fomichev > Cc: Hao Luo > Cc: Jiri Olsa > Cc: > --- > tools/lib/bpf/skel_internal.h | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/tools/lib/bpf/skel_internal.h b/tools/lib/bpf/skel_internal.h > index 6a8f5c7a02eb..8702d6612978 100644 > --- a/tools/lib/bpf/skel_internal.h > +++ b/tools/lib/bpf/skel_internal.h > @@ -243,7 +243,8 @@ static inline int skel_map_create(enum bpf_map_type map_type, > attr.excl_prog_hash = (unsigned long) excl_prog_hash; > attr.excl_prog_hash_size = excl_prog_hash_sz; > > - strncpy(attr.map_name, map_name, sizeof(attr.map_name)); > + memcpy(attr.map_name, map_name, > + strnlen(map_name, sizeof(attr.map_name))); > attr.key_size = key_size; > attr.value_size = value_size; > attr.max_entries = max_entries; > -- > 2.34.1 >