linux-kernel - Re: [PATCH v2] mmc: mmc_spi: drop buggy snprintf()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAPDyKFqvpSJCpG00NtDwpuxp51T8t9JGMm6Ssxvzpg4fNGSGBQ@mail.gmail.com>
Date: Wed, 9 Oct 2024 12:37:43 +0200
From: Ulf Hansson <ulf.hansson@...aro.org>
To: Bartosz Golaszewski <brgl@...ev.pl>
Cc: linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Bartosz Golaszewski <bartosz.golaszewski@...aro.org>, 
	Christophe JAILLET <christophe.jaillet@...adoo.fr>
Subject: Re: [PATCH v2] mmc: mmc_spi: drop buggy snprintf()

On Tue, 8 Oct 2024 at 18:01, Bartosz Golaszewski <brgl@...ev.pl> wrote:
>
> From: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
>
> GCC 13 complains about the truncated output of snprintf():
>
> drivers/mmc/host/mmc_spi.c: In function ‘mmc_spi_response_get’:
> drivers/mmc/host/mmc_spi.c:227:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
>   227 |         snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
>       |                                                                ^
> drivers/mmc/host/mmc_spi.c:227:9: note: ‘snprintf’ output between 26 and 43 bytes into a destination of size 32
>   227 |         snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
>       |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>   228 |                 cmd->opcode, maptype(cmd));
>
> Drop it and fold the string it generates into the only place where it's
> emitted - the dev_dbg() call at the end of the function.
>
> Fixes: 15a0580ced08 ("mmc_spi host driver")
> Suggested-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>

Applied for next, thanks!

Kind regards
Uffe


> ---
> - instead of fixing the buffer size, just drop the snprintf() call
>   altogether
>
>  drivers/mmc/host/mmc_spi.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
> index 8fee7052f2ef..47443fb5eb33 100644
> --- a/drivers/mmc/host/mmc_spi.c
> +++ b/drivers/mmc/host/mmc_spi.c
> @@ -222,10 +222,6 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,
>         u8      leftover = 0;
>         unsigned short rotator;
>         int     i;
> -       char    tag[32];
> -
> -       snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
> -               cmd->opcode, maptype(cmd));
>
>         /* Except for data block reads, the whole response will already
>          * be stored in the scratch buffer.  It's somewhere after the
> @@ -378,8 +374,9 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,
>         }
>
>         if (value < 0)
> -               dev_dbg(&host->spi->dev, "%s: resp %04x %08x\n",
> -                       tag, cmd->resp[0], cmd->resp[1]);
> +               dev_dbg(&host->spi->dev,
> +                       "  ... CMD%d response SPI_%s: resp %04x %08x\n",
> +                       cmd->opcode, maptype(cmd), cmd->resp[0], cmd->resp[1]);
>
>         /* disable chipselect on errors and some success cases */
>         if (value >= 0 && cs_on)
> --
> 2.43.0
>