Skip to content

Commit 164a8c0

Browse files
keesNipaLocal
authored andcommitted
cxgb3: Avoid potential string truncation in desc
Builds with W=1 were warning about potential string truncations: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c: In function 'cxgb_up': drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:38: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 5 and 20 [-Wformat-truncation=] 394 | "%s-%d", d->name, pi->first_qset + i); | ^~ In function 'name_msix_vecs', inlined from 'cxgb_up' at drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:1264:3: drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:394:34: note: directive argument in the range [-2147483641, 509] 394 | "%s-%d", d->name, pi->first_qset + i); | ^~~~~~~ drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c:393:25: note: 'snprintf' output between 3 and 28 bytes into a destination of size 21 393 | snprintf(adap->msix_info[msi_idx].desc, n, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 394 | "%s-%d", d->name, pi->first_qset + i); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Avoid open-coded %NUL-termination (this code was assuming snprintf wasn't %NUL terminating when it does -- likely thinking of strncpy), and grow the size of the string to handle a maximal value. Reported-by: kernel test robot <[email protected]> Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/ Cc: Raju Rangoju <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Jakub Kicinski <[email protected]> Cc: Paolo Abeni <[email protected]> Cc: [email protected] Signed-off-by: Kees Cook <[email protected]> Signed-off-by: NipaLocal <nipa@local>
1 parent 52c1b36 commit 164a8c0

File tree

2 files changed

+5
-6
lines changed

2 files changed

+5
-6
lines changed

drivers/net/ethernet/chelsio/cxgb3/adapter.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ struct adapter {
237237
int msix_nvectors;
238238
struct {
239239
unsigned short vec;
240-
char desc[22];
240+
char desc[IFNAMSIZ + 1 + 12]; /* Needs space for "%s-%d" */
241241
} msix_info[SGE_QSETS + 1];
242242

243243
/* T3 modules */

drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -380,19 +380,18 @@ static irqreturn_t t3_async_intr_handler(int irq, void *cookie)
380380
*/
381381
static void name_msix_vecs(struct adapter *adap)
382382
{
383-
int i, j, msi_idx = 1, n = sizeof(adap->msix_info[0].desc) - 1;
383+
int i, j, msi_idx = 1;
384384

385-
snprintf(adap->msix_info[0].desc, n, "%s", adap->name);
386-
adap->msix_info[0].desc[n] = 0;
385+
strscpy(adap->msix_info[0].desc, adap->name, sizeof(adap->msix_info[0].desc));
387386

388387
for_each_port(adap, j) {
389388
struct net_device *d = adap->port[j];
390389
const struct port_info *pi = netdev_priv(d);
391390

392391
for (i = 0; i < pi->nqsets; i++, msi_idx++) {
393-
snprintf(adap->msix_info[msi_idx].desc, n,
392+
snprintf(adap->msix_info[msi_idx].desc,
393+
sizeof(adap->msix_info[0].desc),
394394
"%s-%d", d->name, pi->first_qset + i);
395-
adap->msix_info[msi_idx].desc[n] = 0;
396395
}
397396
}
398397
}

0 commit comments

Comments
 (0)