Re: [External] Re: [PATCH V3 2/3] mm: add max swappiness arg to lru_gen for anonymous memory only

[Dan Carpenter]

On Thu, May 01, 2025 at 09:56:57AM +0800, Zhongkun He wrote:
> Hi Dan
> 
> On Wed, Apr 30, 2025 at 3:59 PM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> >
> > On Wed, Apr 09, 2025 at 03:06:19PM +0800, Zhongkun He wrote:
> > > +             /* set by userspace for anonymous memory only */
> > > +             if (!strncmp("max", swap_string, sizeof("max"))) {
> >
> > This pattern of strncmp("foo", str, sizeof("foo")) is exactly the same
> > as strcmp().  It doesn't provide any additional security.  The strncmp()
> > function is meant for matching string prefixes and it's a relatively
> > common bug to do this:
> >
> > intended: if (strcmp(string, "prefix", sizeof("prefix") - 1) == 0) {
> >   actual: if (strcmp(string, "prefix", sizeof("prefix")) == 0) {
> >
> 
> Yes, I understand the difference.
> 
> > I have a static checker warning for these:
> > https://lore.kernel.org/all/30210ed77b40b4b6629de659cb56b9ec7832c447.1744452787.git.dan.carpenter@xxxxxxxxxx/
> >
> > If people deliberately misuse the function then it makes it trickier
> > to tell accidental mistakes from deliberate mistakes.
> >
> 
> if (!strncmp("max", swap_string, sizeof("max"))) {
> 
> The length of swap_string is 5 because it's read using sscanf, which
> will add the null terminator \0
> at the end of the string. If we input max into the interface,
> swap_string will contain max\0, which is
> equivalent to the string "max". Since we only need to compare the
> first few characters(There are other
> possible inputs as well.) — effectively treating it as a prefix match
> — I used strncmp.

I'm a not sure I understand.  You say you are treating it as a "prefix
match", but sizeof("max") is 4 so this is not treated as a prefix.  Did
you mean to write strlen("max") which does not include the NUL
terminator?

regards,
dan carpenter