linux-kernel - Re: [PATCH] drm/i195: Fix format string truncation warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251205182813.09231c45@pumpkin>
Date: Fri, 5 Dec 2025 18:28:13 +0000
From: David Laight <david.laight.linux@...il.com>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Tvrtko Ursulin <tursulin@...ulin.net>, Ard Biesheuvel
 <ardb+git@...gle.com>, linux-kernel@...r.kernel.org, Jani Nikula
 <jani.nikula@...ux.intel.com>, Joonas Lahtinen
 <joonas.lahtinen@...ux.intel.com>, Rodrigo Vivi <rodrigo.vivi@...el.com>,
 David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
 intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH] drm/i195: Fix format string truncation warning

On Fri, 5 Dec 2025 11:48:08 +0100
Ard Biesheuvel <ardb@...nel.org> wrote:

> On Sun, 9 Nov 2025 at 19:00, Ard Biesheuvel <ardb@...nel.org> wrote:
...
> > > But I guess much prettier fix would be to simply grow the buffer.
> > >  
> >  
> 
> OK, so something like
> 
> --- a/drivers/gpu/drm/i915/intel_memory_region.h
> +++ b/drivers/gpu/drm/i915/intel_memory_region.h
> @@ -72,7 +72,7 @@ struct intel_memory_region {
>         u16 instance;
>         enum intel_region_id id;
>         char name[16];
> -       char uabi_name[16];
> +       char uabi_name[20];

The observant will notice the 7 bytes of padding following 'private',
and another 7 a little later on.
(I' pretty sure 'bool' is u8).

So extending the buffer doesn't even grow the structure.
The string is only used when printing some stats.
I got lost in a list of #defines and function pointers trying to find
the actual function that did the 'printf'.

	David

>         bool private; /* not for userspace */
> 
>         struct {
> 
> 
> 
> > > Also, hm, how come gcc does not find the mem->name vsnprintf from
> > > intel_memory_region_set_name?
> > >  
> >  
> 
> AFAICT, intel_memory_region_set_name() is never called with a format
> string that could produce more than 15/16 bytes of output.
>