lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <202310200915.jiQ2UbTn-lkp@intel.com>
Date:   Fri, 20 Oct 2023 10:02:16 +0800
From:   kernel test robot <lkp@...el.com>
To:     Parav Pandit <parav@...dia.com>
Cc:     oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
        Pavan Chebbi <pavan.chebbi@...adcom.com>
Subject: drivers/net/virtio_net.c:3613:50: error: 'sprintf' may write a
 terminating nul past the end of the destination

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   ce55c22ec8b223a90ff3e084d842f73cfba35588
commit: d0671115869d19ec76d658c4bf86d3211a8ea121 virtio-net: Reduce debug name field size to 16 bytes
date:   9 months ago
config: x86_64-sof-customedconfig-memory-debug-defconfig (https://download.01.org/0day-ci/archive/20231020/202310200915.jiQ2UbTn-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-12) 11.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231020/202310200915.jiQ2UbTn-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202310200915.jiQ2UbTn-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/net/virtio_net.c: In function 'virtnet_find_vqs':
>> drivers/net/virtio_net.c:3613:50: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=]
    3613 |                 sprintf(vi->rq[i].name, "input.%d", i);
         |                                                  ^
   drivers/net/virtio_net.c:3613:17: note: 'sprintf' output between 8 and 17 bytes into a destination of size 16
    3613 |                 sprintf(vi->rq[i].name, "input.%d", i);
         |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/virtio_net.c:3614:49: error: '%d' directive writing between 1 and 10 bytes into a region of size 9 [-Werror=format-overflow=]
    3614 |                 sprintf(vi->sq[i].name, "output.%d", i);
         |                                                 ^~
   drivers/net/virtio_net.c:3614:41: note: directive argument in the range [0, 2147483646]
    3614 |                 sprintf(vi->sq[i].name, "output.%d", i);
         |                                         ^~~~~~~~~~~
   drivers/net/virtio_net.c:3614:17: note: 'sprintf' output between 9 and 18 bytes into a destination of size 16
    3614 |                 sprintf(vi->sq[i].name, "output.%d", i);
         |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   cc1: all warnings being treated as errors


vim +/sprintf +3613 drivers/net/virtio_net.c

d85b758f72b05a Michael S. Tsirkin 2017-03-09  3568  
986a4f4d452dec Jason Wang         2012-12-07  3569  static int virtnet_find_vqs(struct virtnet_info *vi)
3f9c10b0d478a3 Amit Shah          2011-12-22  3570  {
986a4f4d452dec Jason Wang         2012-12-07  3571  	vq_callback_t **callbacks;
986a4f4d452dec Jason Wang         2012-12-07  3572  	struct virtqueue **vqs;
986a4f4d452dec Jason Wang         2012-12-07  3573  	int ret = -ENOMEM;
986a4f4d452dec Jason Wang         2012-12-07  3574  	int i, total_vqs;
986a4f4d452dec Jason Wang         2012-12-07  3575  	const char **names;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3576  	bool *ctx;
986a4f4d452dec Jason Wang         2012-12-07  3577  
986a4f4d452dec Jason Wang         2012-12-07  3578  	/* We expect 1 RX virtqueue followed by 1 TX virtqueue, followed by
986a4f4d452dec Jason Wang         2012-12-07  3579  	 * possible N-1 RX/TX queue pairs used in multiqueue mode, followed by
986a4f4d452dec Jason Wang         2012-12-07  3580  	 * possible control vq.
986a4f4d452dec Jason Wang         2012-12-07  3581  	 */
986a4f4d452dec Jason Wang         2012-12-07  3582  	total_vqs = vi->max_queue_pairs * 2 +
986a4f4d452dec Jason Wang         2012-12-07  3583  		    virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ);
986a4f4d452dec Jason Wang         2012-12-07  3584  
986a4f4d452dec Jason Wang         2012-12-07  3585  	/* Allocate space for find_vqs parameters */
6396bb221514d2 Kees Cook          2018-06-12  3586  	vqs = kcalloc(total_vqs, sizeof(*vqs), GFP_KERNEL);
986a4f4d452dec Jason Wang         2012-12-07  3587  	if (!vqs)
986a4f4d452dec Jason Wang         2012-12-07  3588  		goto err_vq;
6da2ec56059c3c Kees Cook          2018-06-12  3589  	callbacks = kmalloc_array(total_vqs, sizeof(*callbacks), GFP_KERNEL);
986a4f4d452dec Jason Wang         2012-12-07  3590  	if (!callbacks)
986a4f4d452dec Jason Wang         2012-12-07  3591  		goto err_callback;
6da2ec56059c3c Kees Cook          2018-06-12  3592  	names = kmalloc_array(total_vqs, sizeof(*names), GFP_KERNEL);
986a4f4d452dec Jason Wang         2012-12-07  3593  	if (!names)
986a4f4d452dec Jason Wang         2012-12-07  3594  		goto err_names;
192f68cf35f5ee Jason Wang         2017-07-19  3595  	if (!vi->big_packets || vi->mergeable_rx_bufs) {
6396bb221514d2 Kees Cook          2018-06-12  3596  		ctx = kcalloc(total_vqs, sizeof(*ctx), GFP_KERNEL);
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3597  		if (!ctx)
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3598  			goto err_ctx;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3599  	} else {
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3600  		ctx = NULL;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3601  	}
986a4f4d452dec Jason Wang         2012-12-07  3602  
986a4f4d452dec Jason Wang         2012-12-07  3603  	/* Parameters for control virtqueue, if any */
986a4f4d452dec Jason Wang         2012-12-07  3604  	if (vi->has_cvq) {
986a4f4d452dec Jason Wang         2012-12-07  3605  		callbacks[total_vqs - 1] = NULL;
986a4f4d452dec Jason Wang         2012-12-07  3606  		names[total_vqs - 1] = "control";
986a4f4d452dec Jason Wang         2012-12-07  3607  	}
986a4f4d452dec Jason Wang         2012-12-07  3608  
986a4f4d452dec Jason Wang         2012-12-07  3609  	/* Allocate/initialize parameters for send/receive virtqueues */
986a4f4d452dec Jason Wang         2012-12-07  3610  	for (i = 0; i < vi->max_queue_pairs; i++) {
986a4f4d452dec Jason Wang         2012-12-07  3611  		callbacks[rxq2vq(i)] = skb_recv_done;
986a4f4d452dec Jason Wang         2012-12-07  3612  		callbacks[txq2vq(i)] = skb_xmit_done;
986a4f4d452dec Jason Wang         2012-12-07 @3613  		sprintf(vi->rq[i].name, "input.%d", i);
986a4f4d452dec Jason Wang         2012-12-07 @3614  		sprintf(vi->sq[i].name, "output.%d", i);
986a4f4d452dec Jason Wang         2012-12-07  3615  		names[rxq2vq(i)] = vi->rq[i].name;
986a4f4d452dec Jason Wang         2012-12-07  3616  		names[txq2vq(i)] = vi->sq[i].name;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3617  		if (ctx)
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3618  			ctx[rxq2vq(i)] = true;
986a4f4d452dec Jason Wang         2012-12-07  3619  	}
986a4f4d452dec Jason Wang         2012-12-07  3620  
2e9ca760c289e1 Michael S. Tsirkin 2022-08-16  3621  	ret = virtio_find_vqs_ctx(vi->vdev, total_vqs, vqs, callbacks,
2e9ca760c289e1 Michael S. Tsirkin 2022-08-16  3622  				  names, ctx, NULL);
986a4f4d452dec Jason Wang         2012-12-07  3623  	if (ret)
986a4f4d452dec Jason Wang         2012-12-07  3624  		goto err_find;
3f9c10b0d478a3 Amit Shah          2011-12-22  3625  
986a4f4d452dec Jason Wang         2012-12-07  3626  	if (vi->has_cvq) {
986a4f4d452dec Jason Wang         2012-12-07  3627  		vi->cvq = vqs[total_vqs - 1];
986a4f4d452dec Jason Wang         2012-12-07  3628  		if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VLAN))
f646968f8f7c62 Patrick McHardy    2013-04-19  3629  			vi->dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
986a4f4d452dec Jason Wang         2012-12-07  3630  	}
3f9c10b0d478a3 Amit Shah          2011-12-22  3631  
986a4f4d452dec Jason Wang         2012-12-07  3632  	for (i = 0; i < vi->max_queue_pairs; i++) {
986a4f4d452dec Jason Wang         2012-12-07  3633  		vi->rq[i].vq = vqs[rxq2vq(i)];
d85b758f72b05a Michael S. Tsirkin 2017-03-09  3634  		vi->rq[i].min_buf_len = mergeable_min_buf_len(vi, vi->rq[i].vq);
986a4f4d452dec Jason Wang         2012-12-07  3635  		vi->sq[i].vq = vqs[txq2vq(i)];
986a4f4d452dec Jason Wang         2012-12-07  3636  	}
3f9c10b0d478a3 Amit Shah          2011-12-22  3637  
2fa3c8a8b23041 Tonghao Zhang      2018-05-31  3638  	/* run here: ret == 0. */
3f9c10b0d478a3 Amit Shah          2011-12-22  3639  
3f9c10b0d478a3 Amit Shah          2011-12-22  3640  
986a4f4d452dec Jason Wang         2012-12-07  3641  err_find:
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3642  	kfree(ctx);
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06  3643  err_ctx:
986a4f4d452dec Jason Wang         2012-12-07  3644  	kfree(names);
986a4f4d452dec Jason Wang         2012-12-07  3645  err_names:
986a4f4d452dec Jason Wang         2012-12-07  3646  	kfree(callbacks);
986a4f4d452dec Jason Wang         2012-12-07  3647  err_callback:
986a4f4d452dec Jason Wang         2012-12-07  3648  	kfree(vqs);
986a4f4d452dec Jason Wang         2012-12-07  3649  err_vq:
986a4f4d452dec Jason Wang         2012-12-07  3650  	return ret;
3f9c10b0d478a3 Amit Shah          2011-12-22  3651  }
986a4f4d452dec Jason Wang         2012-12-07  3652  

:::::: The code at line 3613 was first introduced by commit
:::::: 986a4f4d452dec004697f667439d27c3fda9c928 virtio_net: multiqueue support

:::::: TO: Jason Wang <jasowang@...hat.com>
:::::: CC: David S. Miller <davem@...emloft.net>

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ