[PATCH 00/28] Replace remaining strlcat() call sites with snprintf()/seq_buf()

Bill Wendling posted 28 patches 1 week, 2 days ago
arch/arm/kernel/atags_parse.c                 |  7 +-
arch/loongarch/kernel/setup.c                 | 22 +++--
arch/mips/kernel/setup.c                      | 21 ++++-
arch/parisc/kernel/setup.c                    | 16 ++--
arch/x86/kernel/setup.c                       |  8 +-
drivers/comedi/drivers/comedi_bond.c          | 16 ++--
drivers/edac/thunderx_edac.c                  | 67 ++++++++++------
drivers/gpu/drm/display/drm_dp_mst_topology.c | 15 ++--
drivers/gpu/drm/xe/xe_gt_sriov_pf_debugfs.c   | 24 +++---
drivers/input/mouse/synaptics_usb.c           | 29 ++++---
drivers/media/dvb-frontends/si2165.c          | 17 ++--
drivers/net/ethernet/intel/i40e/i40e.h        | 15 +++-
drivers/net/wireless/ath/wil6210/wmi.c        | 38 +++++----
.../broadcom/brcm80211/brcmfmac/firmware.c    | 21 ++---
drivers/of/fdt.c                              | 11 ++-
drivers/pinctrl/samsung/pinctrl-samsung.c     |  3 +-
drivers/scsi/bfa/bfa_fcs.c                    | 80 +++++--------------
fs/nfs/nfsroot.c                              | 11 ++-
fs/orangefs/orangefs-debugfs.c                | 36 ++++-----
include/linux/fortify-string.h                |  7 +-
net/devlink/dev.c                             |  8 +-
net/sunrpc/addr.c                             | 16 ++--
sound/pci/ac97/ac97_codec.c                   |  9 ++-
sound/usb/card.c                              | 58 +++++++++-----
sound/usb/mixer.c                             |  8 +-
25 files changed, 309 insertions(+), 254 deletions(-)
[PATCH 00/28] Replace remaining strlcat() call sites with snprintf()/seq_buf()
Posted by Bill Wendling 1 week, 2 days ago
strlcat() is deprecated: like strcat(), it requires re-scanning the
destination string from the beginning on every call, which is O(n^2)
when used to build up a string incrementally, and its truncation
behavior is easy to get wrong. See:

  https://github.com/KSPP/linux/issues/370

This series removes the remaining strlcat() call sites in the tree
(plus the one inside fortify-string.h's strcat() implementation
itself), replacing each with snprintf(), scnprintf(), or the seq_buf()
API, whichever best fits the surrounding code.

One unrelated fix is included. While auditing drivers/edac/thunderx_edac.c
for its strlcat() conversion, "EDAC/thunderx: Fix stale error context in
thunderx_l2c_threaded_isr()" addresses a pre-existing bug, present since
the driver's original 2017 commit: thunderx_l2c_threaded_isr() computes
its ring "tail"/"ctx" once before its drain loop and never recomputes
them per iteration, unlike the analogous OCX handlers in the same file,
so it re-reports the same ring entry for every queued error instead of
draining the ring. It's split out as its own patch, ahead of the
strlcat() conversion for that file, so it can be reviewed and
backported independently of the rest of this series.

Bill Wendling (28):
  ALSA: ac97: Refactor snd_ac97_get_name() to use snprintf()
  sunrpc: Refactor rpc_sockaddr2uaddr() to use snprintf() instead of
    strlcat()
  ARM: atags: Replace strlcat() with snprintf() for cmdline extend
  scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init()
  ALSA: usb-audio: Refactor usb_audio_make_longname() to use seq_buf
  comedi: comedi_bond: Refactor strlcat() to seq_buf in do_dev_config()
  scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init()
  devlink: Refactor strlcat() to seq_buf in
    __devlink_compat_running_version()
  drm/dp_mst: Refactor build_mst_prop_path() to use seq_buf
  of/fdt: Replace strlcat() with snprintf() in
    early_init_dt_scan_chosen()
  wifi: brcmfmac: Replace strlcat() with snprintf() in
    brcmf_fw_alloc_request()
  fortify: Convert strlcat() to snprintf() in strcat()
  i40e: Replace strlcat() with snprintf() in i40e_nvm_version_str()
  ALSA: usb-audio: Refactor append_ctl_name() to use snprintf()
  orangefs: Use seq_buf for debug help string generation
  pinctrl: samsung: Use snprintf() to construct pin bank names
  MIPS: cmdline: Refactor bootcmdline_append() to use snprintf()
  LoongArch: Refactor bootcmdline_init() to use seq_buf instead of
    strlcat()
  x86/setup: Use snprintf() to concatenate builtin and boot command
    lines
  parisc: Refactor strlcat() to seq_buf in setup_cmdline()
  NFS: nfsroot: Refactor root_nfs_cat() to use snprintf()
  media: si2165: Use snprintf() to format frontend name
  Input: synaptics_usb - use seq_buf and snprintf() for name and phys
  EDAC/thunderx: Fix stale error context in thunderx_l2c_threaded_isr()
  EDAC/thunderx: Replace strlcat() with seq_buf
  wifi: wil6210: Refactor resume_triggers2string() to use seq_buf
  drm/xe/pf: Convert strlcat() to seq_buf in control_read()
  drm/xe/pf: Refactor strlcat() to seq_buf in sched_group_engines_read()

 arch/arm/kernel/atags_parse.c                 |  7 +-
 arch/loongarch/kernel/setup.c                 | 22 +++--
 arch/mips/kernel/setup.c                      | 21 ++++-
 arch/parisc/kernel/setup.c                    | 16 ++--
 arch/x86/kernel/setup.c                       |  8 +-
 drivers/comedi/drivers/comedi_bond.c          | 16 ++--
 drivers/edac/thunderx_edac.c                  | 67 ++++++++++------
 drivers/gpu/drm/display/drm_dp_mst_topology.c | 15 ++--
 drivers/gpu/drm/xe/xe_gt_sriov_pf_debugfs.c   | 24 +++---
 drivers/input/mouse/synaptics_usb.c           | 29 ++++---
 drivers/media/dvb-frontends/si2165.c          | 17 ++--
 drivers/net/ethernet/intel/i40e/i40e.h        | 15 +++-
 drivers/net/wireless/ath/wil6210/wmi.c        | 38 +++++----
 .../broadcom/brcm80211/brcmfmac/firmware.c    | 21 ++---
 drivers/of/fdt.c                              | 11 ++-
 drivers/pinctrl/samsung/pinctrl-samsung.c     |  3 +-
 drivers/scsi/bfa/bfa_fcs.c                    | 80 +++++--------------
 fs/nfs/nfsroot.c                              | 11 ++-
 fs/orangefs/orangefs-debugfs.c                | 36 ++++-----
 include/linux/fortify-string.h                |  7 +-
 net/devlink/dev.c                             |  8 +-
 net/sunrpc/addr.c                             | 16 ++--
 sound/pci/ac97/ac97_codec.c                   |  9 ++-
 sound/usb/card.c                              | 58 +++++++++-----
 sound/usb/mixer.c                             |  8 +-
 25 files changed, 309 insertions(+), 254 deletions(-)
---
Cc: Russell King <linux@armlinux.org.uk>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: x86@kernel.org
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Matthias Schwarzott <zzam@gentoo.org>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
Cc: Rob Herring <robh@kernel.org>
Cc: Saravana Kannan <saravanak@kernel.org>
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Peter Griffin <peter.griffin@linaro.org>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Cc: Linus Walleij <linusw@kernel.org>
Cc: Anil Gurumurthy <anil.gurumurthy@qlogic.com>
Cc: Sudarsana Kalluru <sudarsana.kalluru@qlogic.com>
Cc: "Martin K. Petersen" <mkp@kernel.org>
Cc: Trond Myklebust <trondmy@kernel.org>
Cc: Anna Schumaker <anna@kernel.org>
Cc: Mike Marshall <hubcap@omnibond.com>
Cc: Martin Brandenburg <martin@omnibond.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: Simon Horman <horms@kernel.org>
Cc: Chuck Lever <cel@kernel.org>
Cc: Jeff Layton <jlayton@kernel.org>
Cc: NeilBrown <neil@brown.name>
Cc: Olga Kornievskaia <okorniev@redhat.com>
Cc: Dai Ngo <Dai.Ngo@oracle.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Bill Wendling <morbo@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
Cc: Kanglong Wang <wangkanglong@loongson.cn>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: Qiang Ma <maqianga@uniontech.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Pengpeng Hou <pengpeng@iscas.ac.cn>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Breno Leitao <leitao@debian.org>
Cc: Thorsten Blum <blum@kernel.org>
Cc: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Lyude Paul <lyude@redhat.com>
Cc: Ashutosh Desai <ashutoshdesai993@gmail.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Johan Hovold <johan@kernel.org>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Cc: Alexander Stein <alexander.stein@ew.tq-group.com>
Cc: Cryolitia PukNgae <cryolitia@uniontech.com>
Cc: Jiaming Zhang <r772577952@gmail.com>
Cc: Will Porter <mrwillporter@gmail.com>
Cc: Cen Zhang <zzzccc427@gmail.com>
Cc: "Cássio Gabriel" <cassiogabrielcontato@gmail.com>
Cc: Rong Zhang <i@rong.moe>
Cc: Arun Raghavan <arunr@valvesoftware.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: loongarch@lists.linux.dev
Cc: linux-mips@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Cc: linux-edac@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: intel-xe@lists.freedesktop.org
Cc: linux-input@vger.kernel.org
Cc: linux-media@vger.kernel.org
Cc: intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org
Cc: linux-wireless@vger.kernel.org
Cc: brcm80211@lists.linux.dev
Cc: brcm80211-dev-list.pdl@broadcom.com
Cc: devicetree@vger.kernel.org
Cc: linux-samsung-soc@vger.kernel.org
Cc: linux-gpio@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Cc: linux-nfs@vger.kernel.org
Cc: devel@lists.orangefs.org
Cc: linux-hardening@vger.kernel.org
Cc: linux-sound@vger.kernel.org

-- 
2.47.3
Re: [PATCH 00/28] Replace remaining strlcat() call sites with snprintf()/seq_buf()
Posted by Kees Cook 1 week, 2 days ago
On Tue, Sep 15, 2026 at 08:18:17AM +0000, Bill Wendling wrote:
> strlcat() is deprecated: like strcat(), it requires re-scanning the
> destination string from the beginning on every call, which is O(n^2)
> when used to build up a string incrementally, and its truncation
> behavior is easy to get wrong. See:
> 
>   https://github.com/KSPP/linux/issues/370
> 
> This series removes the remaining strlcat() call sites in the tree
> (plus the one inside fortify-string.h's strcat() implementation
> itself), replacing each with snprintf(), scnprintf(), or the seq_buf()
> API, whichever best fits the surrounding code.

Thanks for tackling this!

A few global notes:

- This series almost certainly needs to be sent as separate single
  patches to each subsystem maintainer (rather than a giant CC list).

- As others noted already, we don't want to do anything as just an
  open-coded strlen/sprintf; this doesn't gain us anything. If we can't
  use seq_buf or some other solution, we need to figure out what we _can_
  do for a given use.

- There are some collisions with other in-flight patches, e.g.  Mariia's[1]

- The "Assisted-by:" trailer doesn't need the level of detail you've
  got, which changed recently[2]. Now the desired trailer would just be:
    Assisted-by: LLM

- Please avoid including the Cc list in the email body (above or below
  the "---" line), as it ends up being redundant.

I'll go look through the individual patches...

-Kees

[1] https://lore.kernel.org/all/27956255dde39f58d73a7b51cb53cbe3d7804f54.1786411026.git.mariianikitash@google.com/
[2] https://git.kernel.org/linus/816d9992d9ed ("coding-assistants: simplify attribution")

-- 
Kees Cook
Re: [PATCH 00/28] Replace remaining strlcat() call sites with snprintf()/seq_buf()
Posted by Takashi Iwai 1 week, 2 days ago
On Tue, 15 Sep 2026 10:18:17 +0200,
Bill Wendling wrote:
> 
> strlcat() is deprecated: like strcat(), it requires re-scanning the
> destination string from the beginning on every call, which is O(n^2)
> when used to build up a string incrementally, and its truncation
> behavior is easy to get wrong.

... but what many of your patches do is to replace strlcat() with
open-codes, which is more error-prone and easier to get wrong than
a single strlcat() call.

> See:
> 
>   https://github.com/KSPP/linux/issues/370

It's clear that strlcat() isn't perfect and sometimes inefficient.
But blindly deprecating without providing a good alternative doesn't
sound like a right approach to me.


thanks,

Takashi