lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 11 Oct 2023 01:06:43 +0300
From: Vladimir Oltean <olteanv@...il.com>
To: Justin Stitt <justinstitt@...gle.com>
Cc: Linus Walleij <linus.walleij@...aro.org>,
	Alvin Šipraga <alsi@...g-olufsen.dk>,
	Andrew Lunn <andrew@...n.ch>,
	Florian Fainelli <f.fainelli@...il.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org
Subject: Re: [PATCH] net: dsa: realtek: rtl8365mb: replace deprecated strncpy
 with ethtool_sprintf

On Tue, Oct 10, 2023 at 02:48:07PM -0700, Justin Stitt wrote:
> On Tue, Oct 10, 2023 at 10:36 AM Justin Stitt <justinstitt@...gle.com> wrote:
> > > Is there any particular reason why you opted for the "%s" printf format
> > > specifier when you could have simply given mib->name as the single
> > > argument? This comment applies to all the ethtool_sprintf() patches
> > > you've submitted.
> >
> > Yeah, it causes a -Wformat-security warning for me. I briefly mentioned it
> > in one of my first patches like this [1].
> 
> For more context, here's some warnings in the wild:
> https://lore.kernel.org/netdev/20231003183603.3887546-3-jesse.brandeburg@intel.com/
> 
> >
> > [1]: https://lore.kernel.org/all/20231005-strncpy-drivers-net-dsa-lan9303-core-c-v2-1-feb452a532db@google.com/

Yeah, ok. It's a false positive warning, but I guess it would be too
hard for the compiler to figure that out.

Powered by blists - more mailing lists