linux-kernel - Re: [PATCH v1 1/1] genirq: Bump the size of the local variable for sprintf()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aCi61d4gYWeC5zbn@smile.fi.intel.com>
Date: Sat, 17 May 2025 19:35:33 +0300
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Jiri Slaby <jirislaby@...nel.org>
Cc: Thomas Gleixner <tglx@...utronix.de>, linux-kernel@...r.kernel.org,
	kernel test robot <lkp@...el.com>
Subject: Re: [PATCH v1 1/1] genirq: Bump the size of the local variable for
 sprintf()

On Fri, May 16, 2025 at 12:23:17PM +0200, Jiri Slaby wrote:
> On 16. 05. 25, 11:07, Andy Shevchenko wrote:
> > On Fri, May 16, 2025 at 06:45:04AM +0200, Jiri Slaby wrote:
> > > On 15. 05. 25, 10:55, Andy Shevchenko wrote:

...

> > > > -	char name [10];
> > > > +	char name [12];
> > > 
> > > The max irq is ~ 512000, if I am counting correctly, so 7 B should be
> > > actually enough for everybody ;).
> > 
> > GCC can't proved it. And FWIW, on current Debian unstable (GCC 14?) I can't
> > reproduce this. In any case this doesn't increase stack usage AFAICT, the array
> > already have reserved 12 or 16 bytes.
> 
> Yes, sure, I am not disputing the fix.
> 
> > > But well, can we silence the warning in a better way? I doubt that...
> > 
> > With the above said, I think it's pretty much close to the best way.
> > But if you find anything better, I also would like to learn.
> 
> Perhaps next in row would be using snprintf(), but dunno if it's better at
> all.

Try it. I believe you will get the same result. The problem is not in 'n' or
'n'-less variant, the problem is that GCC can't prove the limits of the input
value.

-- 
With Best Regards,
Andy Shevchenko