linux-kernel - Re: [PATCH v1 1/1] usb: hcd: Bump local buffer size in rh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z4peQ4AhE7JzuSFX@smile.fi.intel.com>
Date: Fri, 17 Jan 2025 15:42:27 +0200
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 1/1] usb: hcd: Bump local buffer size in rh_string()

On Fri, Jan 17, 2025 at 07:11:46AM +0100, Greg Kroah-Hartman wrote:
> On Thu, Jan 16, 2025 at 06:05:43PM +0200, Andy Shevchenko wrote:
> > GCC is not happy about the buffer size:
> > 
> > drivers/usb/core/hcd.c:441:48: error: ‘%s’ directive output may be truncated writing up to 64 bytes into a region of size between 35 and 99 [-Werror=format-truncation=]
> >   441 |                 snprintf (buf, sizeof buf, "%s %s %s", init_utsname()->sysname,
> >       |                                                ^~
> >   442 |                         init_utsname()->release, hcd->driver->description);
> >       |                         ~~~~~~~~~~~~~~~~~~~~~~~
> > 
> > Bump the size to get it enough for the possible strings.

...

> >  static unsigned
> >  rh_string(int id, struct usb_hcd const *hcd, u8 *data, unsigned len)
> >  {
> > -	char buf[100];
> > +	char buf[160];
> >  	char const *s;
> >  	static char const langids[4] = {4, USB_DT_STRING, 0x09, 0x04};
> 
> Worst case it's properly truncated so why do we need to worry about this
> "warning"?

With CONFIG_WERROR=y it's a compilation error. My goal is to have
i386_defconfig and x86_64_defconfig to be compiled with `make W=1`.

> And what compiler version is giving that, I don't see that
> here in my build testing.

`make W=1` (and be sure that CONFIG_WERROR=y).

$ gcc --version
gcc (Debian 14.2.0-12) 14.2.0

(IIRC that had been started with any GCC from v13?)

-- 
With Best Regards,
Andy Shevchenko