linux-kernel - Re: drivers/opp/debugfs.c:48:54: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size 8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZeavsDQNBA/txKyb@yujie-X299>
Date: Tue, 5 Mar 2024 13:37:52 +0800
From: Yujie Liu <yujie.liu@...el.com>
To: Viresh Kumar <viresh.kumar@...aro.org>
CC: lkp <lkp@...el.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "oe-kbuild-all@...ts.linux.dev"
	<oe-kbuild-all@...ts.linux.dev>
Subject: Re: drivers/opp/debugfs.c:48:54: warning: '%d' directive output may
 be truncated writing between 1 and 11 bytes into a region of size 8

On Mon, Mar 04, 2024 at 04:51:02PM +0530, Viresh Kumar wrote:
> On 04-03-24, 16:30, Yujie Liu wrote:
> > This fixes the warning for "supply-%d". Seems there are other remaining
> > warnings as shown below. Would you like to take a look as well?
> 
> How about this instead to fix all warnings (drop the earlier change
> please) ?

We see the following errors after applying the new diff:

  CC      drivers/opp/debugfs.o
drivers/opp/debugfs.c: In function 'opp_debug_create_one':
drivers/opp/debugfs.c:92:57: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=]
   92 |                 snprintf(name, sizeof(name), "rate_hz_%d", i);
      |                                                         ^
In function 'opp_debug_create_clks',
    inlined from 'opp_debug_create_one' at drivers/opp/debugfs.c:164:2:
drivers/opp/debugfs.c:92:17: note: 'snprintf' output between 10 and 20 bytes into a destination of size 19
   92 |                 snprintf(name, sizeof(name), "rate_hz_%d", i);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/opp/debugfs.c: In function 'opp_debug_create_one':
drivers/opp/debugfs.c:107:56: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=]
  107 |                 snprintf(name, sizeof(name), "supply-%d", i);
      |                                                        ^
In function 'opp_debug_create_supplies',
    inlined from 'opp_debug_create_one' at drivers/opp/debugfs.c:165:2:
drivers/opp/debugfs.c:107:17: note: 'snprintf' output between 9 and 19 bytes into a destination of size 18
  107 |                 snprintf(name, sizeof(name), "supply-%d", i);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


An integer has positive and negative limits, and the range is from
-2147483648 to 2147483647 in decimal, so it seems that an integer can
have 11 digits at most.

> 
> diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c
> index ec030b19164a..a9ebfdf0b6a1 100644
> --- a/drivers/opp/debugfs.c
> +++ b/drivers/opp/debugfs.c
> @@ -37,10 +37,12 @@ static ssize_t bw_name_read(struct file *fp, char __user *userbuf,
>                             size_t count, loff_t *ppos)
>  {
>         struct icc_path *path = fp->private_data;
> +       const char *name = icc_get_name(path);
>         char buf[64];
> -       int i;
> +       int i = 0;
> 
> -       i = scnprintf(buf, sizeof(buf), "%.62s\n", icc_get_name(path));
> +       if (name)
> +               i = scnprintf(buf, sizeof(buf), "%.62s\n", name);
> 
>         return simple_read_from_buffer(userbuf, count, ppos, buf, i);
>  }
> @@ -56,11 +58,11 @@ static void opp_debug_create_bw(struct dev_pm_opp *opp,
>                                 struct dentry *pdentry)
>  {
>         struct dentry *d;
> -       char name[20];
> +       char name[] = "icc-path-XXXXXXXXXX"; /* Integers can take 10 chars max */
>         int i;
> 
>         for (i = 0; i < opp_table->path_count; i++) {
> -               snprintf(name, sizeof(name), "icc-path-%.1d", i);
> +               snprintf(name, sizeof(name), "icc-path-%d", i);
> 
>                 /* Create per-path directory */
>                 d = debugfs_create_dir(name, pdentry);
> @@ -78,7 +80,7 @@ static void opp_debug_create_clks(struct dev_pm_opp *opp,
>                                   struct opp_table *opp_table,
>                                   struct dentry *pdentry)
>  {
> -       char name[12];
> +       char name[] = "rate_hz_XXXXXXXXXX"; /* Integers can take 10 chars max */
>         int i;
> 
>         if (opp_table->clk_count == 1) {
> @@ -100,7 +102,7 @@ static void opp_debug_create_supplies(struct dev_pm_opp *opp,
>         int i;
> 
>         for (i = 0; i < opp_table->regulator_count; i++) {
> -               char name[15];
> +               char name[] = "supply-XXXXXXXXXX"; /* Integers can take 10 chars max */
> 
>                 snprintf(name, sizeof(name), "supply-%d", i);
> 
> -- 
> viresh