| Message ID | 20231212220954.work.219-kees@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | bc044ae9d64b1b23fa3a3aa5c162afec8348b412 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | cxgb3: Avoid potential string truncation in desc | expand |
Hello: This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 12 Dec 2023 14:09:57 -0800 you wrote: > Builds with W=1 were warning about potential string truncations: > > drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c: In function 'cxgb_up': > drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:38: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 5 and 20 [-Wformat-truncation=] > 394 | "%s-%d", d->name, pi->first_qset + i); > | ^~ > In function 'name_msix_vecs', > inlined from 'cxgb_up' at drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:1264:3: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:34: note: directive argument in the range [-2147483641, 509] > 394 | "%s-%d", d->name, pi->first_qset + i); > | ^~~~~~~ > drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:393:25: note: 'snprintf' output between 3 and 28 bytes into a destination of size 21 > 393 | snprintf(adap->msix_info[msi_idx].desc, n, > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > 394 | "%s-%d", d->name, pi->first_qset + i); > | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > [...] Here is the summary with links: - cxgb3: Avoid potential string truncation in desc https://git.kernel.org/netdev/net-next/c/bc044ae9d64b You are awesome, thank you!
diff --git a/drivers/net/ethernet/chelsio/cxgb3/adapter.h b/drivers/net/ethernet/chelsio/cxgb3/adapter.h index 6d682b7c7aac..9d11e55981a0 100644 --- a/drivers/net/ethernet/chelsio/cxgb3/adapter.h +++ b/drivers/net/ethernet/chelsio/cxgb3/adapter.h @@ -237,7 +237,7 @@ struct adapter { int msix_nvectors; struct { unsigned short vec; - char desc[22]; + char desc[IFNAMSIZ + 1 + 12]; /* Needs space for "%s-%d" */ } msix_info[SGE_QSETS + 1]; /* T3 modules */ diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c index d117022d15d7..2236f1d35f2b 100644 --- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c @@ -380,19 +380,18 @@ static irqreturn_t t3_async_intr_handler(int irq, void *cookie) */ static void name_msix_vecs(struct adapter *adap) { - int i, j, msi_idx = 1, n = sizeof(adap->msix_info[0].desc) - 1; + int i, j, msi_idx = 1; - snprintf(adap->msix_info[0].desc, n, "%s", adap->name); - adap->msix_info[0].desc[n] = 0; + strscpy(adap->msix_info[0].desc, adap->name, sizeof(adap->msix_info[0].desc)); for_each_port(adap, j) { struct net_device *d = adap->port[j]; const struct port_info *pi = netdev_priv(d); for (i = 0; i < pi->nqsets; i++, msi_idx++) { - snprintf(adap->msix_info[msi_idx].desc, n, + snprintf(adap->msix_info[msi_idx].desc, + sizeof(adap->msix_info[0].desc), "%s-%d", d->name, pi->first_qset + i); - adap->msix_info[msi_idx].desc[n] = 0; } } }
Builds with W=1 were warning about potential string truncations: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c: In function 'cxgb_up': drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:38: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 5 and 20 [-Wformat-truncation=] 394 | "%s-%d", d->name, pi->first_qset + i); | ^~ In function 'name_msix_vecs', inlined from 'cxgb_up' at drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:1264:3: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:34: note: directive argument in the range [-2147483641, 509] 394 | "%s-%d", d->name, pi->first_qset + i); | ^~~~~~~ drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:393:25: note: 'snprintf' output between 3 and 28 bytes into a destination of size 21 393 | snprintf(adap->msix_info[msi_idx].desc, n, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 394 | "%s-%d", d->name, pi->first_qset + i); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Avoid open-coded %NUL-termination (this code was assuming snprintf wasn't %NUL terminating when it does -- likely thinking of strncpy), and grow the size of the string to handle a maximal value. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202312100937.ZPZCARhB-lkp@intel.com/ Cc: Raju Rangoju <rajur@chelsio.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/net/ethernet/chelsio/cxgb3/adapter.h | 2 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-)