cxgb3: Avoid potential string truncation in desc
Subsystems (3)
PATCH 1/1 cxgb3: Avoid potential string truncation in desc
Builds with W=1 were warning about potential string truncations:
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c: In function 'cxgb_up':drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:38: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 5 and 20 [-Wformat-truncation=]
394 | "%s-%d", d->name, pi->first_qset + i);
| ^~
In function 'name_msix_vecs',
inlined from 'cxgb_up' at drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:1264:3: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:34: note: directive argument in the range [-2147483641, 509]
394 | "%s-%d", d->name, pi->first_qset + i);
| ^~~~~~~
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:393:25: note: 'snprintf' output between 3 and 28 bytes into a destination of size 21
393 | snprintf(adap->msix_info[msi_idx].desc, n,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
394 | "%s-%d", d->name, pi->first_qset + i);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Avoid open-coded %NUL-termination (this code was assuming snprintf wasn't %NUL terminating when it does -- likely thinking of strncpy), and grow the size of the string to handle a maximal value.
--- drivers/net/ethernet/chelsio/cxgb3/adapter.h | 2 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/chelsio/cxgb3/adapter.h +1 -1
@@ -237,7 +237,7 @@ struct adapter {int msix_nvectors;struct {unsigned short vec; -char desc[22 ]; +char desc[IFNAMSIZ +1 +12 ];/* Needs space for "%s-%d" */ } msix_info[SGE_QSETS +1 ];/* T3 modules */
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +4 -5
@@ -380,19 +380,18 @@ static irqreturn_t t3_async_intr_handler(int irq, void *cookie)*/ static void name_msix_vecs (struct adapter *adap) { -int i, j, msi_idx =1 , n =sizeof (adap->msix_info[0 ].desc) -1 ; +int i, j, msi_idx =1 ; -snprintf (adap->msix_info[0 ].desc, n,"%s" , adap->name); - adap->msix_info[0 ].desc[n] =0 ; +strscpy (adap->msix_info[0 ].desc, adap->name,sizeof (adap->msix_info[0 ].desc));for_each_port (adap, j) {struct net_device *d = adap->port[j];const struct port_info *pi =netdev_priv (d);for (i =0 ; i < pi->nqsets; i++, msi_idx++) { -snprintf (adap->msix_info[msi_idx].desc, n, +snprintf (adap->msix_info[msi_idx].desc, +sizeof (adap->msix_info[0 ].desc),"%s-%d" , d->name, pi->first_qset + i); - adap->msix_info[msi_idx].desc[n] =0 ; } } }
Signature · 1 line
2.34.1
This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <[email protected]>:
Hello:
This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <[email protected]>:
Quoted 16 lines · On Tue, 12 Dec 2023 14:09:57 -0800 you wrote:
Builds with W=1 were warning about potential string truncations:
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c: In function 'cxgb_up':drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:38: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 5 and 20 [-Wformat-truncation=]
394 | "%s-%d",d->name,pi->first_qset+ i);
| ^~
In function 'name_msix_vecs',inlined from 'cxgb_up' at drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:1264:3: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:34: note: directive argument in the range [-2147483641, 509] 394 | "%s-%d", d->name, pi->first_qset + i); | ^~~~~~~ drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:393:25: note: 'snprintf' output between 3 and 28 bytes into a destination of size 21 393 | snprintf(adap->msix_info[msi_idx].desc, n, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 394 | "%s-%d", d->name, pi->first_qset + i); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Quoted 1 line
[...]
Here is the summary with links:
- cxgb3: Avoid potential string truncation in desc
https://git.kernel.org/netdev/net-next/c/bc044ae9d64b
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html