scsi: qedi: silence sprintf() overflow warning

PATCH In review Dan Carpenter 2 participants 3 messages Feb 7, 2017 – Jul 7, 2017

Subsystems (3)

SCSI Kernel janitors QLogic QL41xxx iSCSI driver

lore

Share & tools

lore

Dan Carpenter

author

2017-02-07 13:01 UTC #0 lore raw

PATCH 1/1 scsi: qedi: silence sprintf() overflow warning

The problem here is this:

	sprintf(host_buf, "qedi_ofld%d", qedi->shost->host_no);

host_buf is 16 character so we only have 6 characters left for ->host_no. But ->host_no is set in scsi_host_alloc():

	index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);

It could theoretically go up to 0x8000000 so we need space for 10 digits.

Signed-off-by Dan Carpenter <[email protected]>

drivers/scsi/qedi/qedi_main.c +1 -1

index 5eda21d903e9..0dcf3b08230c 100644
@@ -1735,7 +1735,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
 	u32 dp_module = 0;
 	u8 dp_level = 0;
 	bool is_vf = false;
-	char host_buf[16];
+	char host_buf[20];
 	struct qed_link_params link_params;
 	struct qed_slowpath_params sp_params;
 	struct qed_probe_params qed_params;

walter harms

2017-02-07 13:27 UTC #1 lore raw

Am 07.02.2017 14:01, schrieb Dan Carpenter:

Quoted 28 lines

The problem here is this:
	sprintf(host_buf, "qedi_ofld%d", qedi->shost->host_no);
host_buf is 16 character so we only have 6 characters left for ->host_no. But ->host_no is set in scsi_host_alloc():
	index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
It could theoretically go up to 0x8000000 so we need space for 10 digits.
Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/qedi/qedi_main.c +1 -2
index 5eda21d903e9..0dcf3b08230c 100644
@@ -1735,7 +1735,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
 	u32 dp_module = 0;
 	u8 dp_level = 0;
 	bool is_vf = false;
-	char host_buf[16];
+	char host_buf[20];
 	struct qed_link_params link_params;
 	struct qed_slowpath_params sp_params;
 	struct qed_probe_params qed_params;
--

Quoted 4 lines

To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

any chance to use snprintf here ?
sprintf(host_buf, "qedi_ofld%d", qedi->shost->host_no);

or something like asprint() :)

if ever anyone change the type to very_long_type in the future it would simply break but not hurt.

re,
wh

Dan Carpenter

author

2017-07-07 12:09 UTC #2 lore raw

Quoted 39 lines · walter harms

Am 07.02.2017 14:01, schrieb Dan Carpenter:
Quoted 28 lines
The problem here is this:
	sprintf(host_buf, "qedi_ofld%d", qedi->shost->host_no);
host_buf is 16 character so we only have 6 characters left for ->host_no. But ->host_no is set in scsi_host_alloc():
	index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
It could theoretically go up to 0x8000000 so we need space for 10 digits.
Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/qedi/qedi_main.c +1 -2
index 5eda21d903e9..0dcf3b08230c 100644
@@ -1735,7 +1735,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
 	u32 dp_module = 0;
 	u8 dp_level = 0;
 	bool is_vf = false;
-	char host_buf[16];
+	char host_buf[20];
 	struct qed_link_params link_params;
 	struct qed_slowpath_params sp_params;
 	struct qed_probe_params qed_params;
--
Quoted 4 lines
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
any chance to use snprintf here ?
sprintf(host_buf, "qedi_ofld%d", qedi->shost->host_no);

Quoted 4 lines

or something like asprint() :)
if ever anyone change the type to very_long_type in the future it would simply break but not hurt.

No, I don't think that's required. There are infinite possible futures and the future you're describing is not likely. We'd just end up making the code more complicated for no reason.

regards,
dan carpenter