Re: [PATCH 1/5] Input: joystick - replace strlcat() with strscpy()

[Alejandro Colomar <alx@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1394 bytes --]

Hi Greg,

> Date: 2026-10-19 10:44:22+0200
> From: Greg KH <greg@kroah.com>
>
[...]
> > > I'm all for that too, and putting it in the USB core for everyone to use
> > > would be great.
> > 
> > You might be interested in <https://lore.kernel.org/linux-hardening/cover.1751747518.git.alx@kernel.org/>.
> > I was working on something like that, but actually much simpler.
> > It is meant to replace strscpy()/snprintf() by versions more similar to
> > Plan9's strecpy(2)/seprint(2), but without some important flaw that the
> > Plan9 APIs have (about handling NULL).
> 
> Look at the patches from Kees on the hardening list for the seqbuf
> stuff, that ideally will replace these types of string functions
> entirely over time.

I have looked at them.  I personally think some of them are a bit
unnecessarily complex, by being designed around lengths instead of
offset pointers.

Essentially, his API is a wrapper around the usual strscpy()/snprintf(3)
operations, but because those fundamental operations are themselves
flawed, their wrapper is inherently flawed too.  stpecpy()/seprintf()
are the same, but are simpler to use raw, and by being simpler to use,
their wrappers would naturally because also simpler.

I'm trying to convince Kees of this.  :-)


Have a lovely night!
Alex

> 
> thanks,
> 
> greg k-h

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]