Re: [PATCH] m68k: mm: Remove size argument when calling strscpy()

[Finn Thain]

On Fri, 7 Mar 2025, Geert Uytterhoeven wrote:

> On Fri, 7 Mar 2025 at 00:24, Finn Thain <fthain@xxxxxxxxxxxxxx> wrote:
> > On Thu, 6 Mar 2025, Geert Uytterhoeven wrote:
> > > On Mon, 3 Mar 2025 at 00:07, Thorsten Blum <thorsten.blum@xxxxxxxxx> wrote:
> > > > The size parameter of strscpy() is optional and specifying the 
> > > > size of the destination buffer is unnecessary. Remove it to 
> > > > simplify the code.
> > > >
> > > > Signed-off-by: Thorsten Blum <thorsten.blum@xxxxxxxxx>
> > >
> > > Reviewed-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> i.e. will 
> > > queue in the m68k tree for v6.15.
> >
> > The commit message says "simplify the code" which is only true if you 
> > never scratch the surface (i.e. it's simple code if the reader is 
> > simple too...)
> 
> The code is simpler in the sense that the API is simpler to use, and 
> harder to abuse (i.e. to get it wrong).
> 
> > Commit 30035e45753b ("string: provide strscpy()") was a good idea. It 
> > was easily auditable. But that's not what we have now.
> >
> > Patches like this one (which appear across the whole tree) need 
> > reviewers (lots of them) that know what kind of a bounds check you end 
> > up with when you ask an arbitary compiler to evaluate this:
> >
> > sizeof(dst) + __must_be_array(dst) + __must_be_cstr(dst) + 
> > __must_be_cstr(src)
> >
> > Frankly, I can't be sure. But it's a serious question, and not what 
> > I'd call a "simple" one.
> 
> All the __must_be_*() macros evaluate to zero when true, and cause a 
> build failure when false.
> 

It seems to me that the code review problem could be solved either by not 
churning the whole tree, or if we must have the churn, by short-circuiting 
the recursive search by reviewers for macro definitions.

Can we do something like this?

sizeof(dst) * !!__must_be_array(dst) * !!__must_be_cstr(dst) * !!__must_be_cstr(src)

At first glance multiplication appears to be safe (unlike all the addition 
terms that we have) because the limit of the string copy is either 
unchanged or zeroed.

Yes, I know you said "zero when true". That looks like another design flaw 
to me. But maybe I'm missing something that's more important than 
readability and ease of review.

> BTW, Linux does not support being built by an "arbitrary compiler": only 
> gcc and clang are supported.
> 

So only gcc and clang must agree about all of the details...