Re: [PATCH 00/28] Replace remaining strlcat() call sites with snprintf()/seq_buf()

[Kees Cook]

On Tue, Sep 15, 2026 at 08:18:17AM +0000, Bill Wendling wrote:
> strlcat() is deprecated: like strcat(), it requires re-scanning the
> destination string from the beginning on every call, which is O(n^2)
> when used to build up a string incrementally, and its truncation
> behavior is easy to get wrong. See:
> 
>   https://github.com/KSPP/linux/issues/370
> 
> This series removes the remaining strlcat() call sites in the tree
> (plus the one inside fortify-string.h's strcat() implementation
> itself), replacing each with snprintf(), scnprintf(), or the seq_buf()
> API, whichever best fits the surrounding code.

Thanks for tackling this!

A few global notes:

- This series almost certainly needs to be sent as separate single
  patches to each subsystem maintainer (rather than a giant CC list).

- As others noted already, we don't want to do anything as just an
  open-coded strlen/sprintf; this doesn't gain us anything. If we can't
  use seq_buf or some other solution, we need to figure out what we _can_
  do for a given use.

- There are some collisions with other in-flight patches, e.g.  Mariia's[1]

- The "Assisted-by:" trailer doesn't need the level of detail you've
  got, which changed recently[2]. Now the desired trailer would just be:
    Assisted-by: LLM

- Please avoid including the Cc list in the email body (above or below
  the "---" line), as it ends up being redundant.

I'll go look through the individual patches...

-Kees

[1] https://lore.kernel.org/all/27956255dde39f58d73a7b51cb53cbe3d7804f54.1786411026.git.mariianikitash@xxxxxxxxxx/
[2] https://git.kernel.org/linus/816d9992d9ed ("coding-assistants: simplify attribution")

-- 
Kees Cook