Kees Cook

We can remove strncpy() from the Linux kernel finally! I did the last 6 instances, and dropped all the implementations:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=dev/v7.0-rc2/strncpy

Over the last 6 years working on this, there were 362 commits by 70 contributors. The folks with more than 1 commit were:

211 Justin Stitt
22 Xu Panda
21 Kees Cook
17 Thorsten Blum
12 Arnd Bergmann
4 Pranav Tyagi
4 Lee Jones
2 Steven Rostedt
2 Sam Ravnborg
2 Marcelo Moreira
2 Krzysztof Kozlowski
2 Kalle Valo
2 Jaroslav Kysela
2 Daniel Thompson
2 Andrew Lunn

Thank you to all of you! (And especially to Justin Stitt who took on the brunt of the work.)

RE: @lwn@fedi.lwn.net

And when you make changes to 20,000 kmalloc calls, you start getting CCed on a LOT of patches since you touched "neighboring code" recently. 😭

@pinskia@hachyderm.io Yeah, it certainly would. It'd be nice to add, though it seems like Linux will need to use this option for older compilers anyway. :)

The Coverity scanning for Linux has been broken for the last month. I tracked down the root cause, and it looks like scanning will be offline for the forseeable future. Coverity doesn't appear to support transparent struct members, which Linux enabled support for with `-fms-extensions` after v6.18.

I wonder what other static analyzers are going to fall over due to this. Is sparse happy with those structs? Regardless, I'm quite happy to have this feature available. It makes a number of things much nicer as far as constructing easy-to-use structs.

https://community.blackduck.com/s/question/0D5Ul00000d0A95KAE/linux-scanning-is-broken-coverity-needs-to-support-fmsextensions-option

@torvalds@social.kernel.org The "continue to function properly" language came from Vizio, though. That's not a claim SFC ever made. That wouldn't even be covered by GPLv3. 🤷 https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelevant-ruling/

@jvoisin@infosec.exchange I interviewed for Canonical in 2006, and it was MUCH less arduous then. I found my interview with Mark to be quite curious as well, and it took me a couple weeks to figure out what he was evaluating. I think he was trying to assess *loyalty*.