| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202512301705.ho4pVldQ-lkp@intel.com>
Date: Tue, 30 Dec 2025 18:00:40 +0800
From: kernel test robot <lkp@...el.com>
To: Paolo Abeni <pabeni@...hat.com>
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: drivers/net/virtio_net.c:6492:36: warning: 'sprintf' may
write a terminating nul past the end of the destination
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 8640b74557fc8b4c300030f6ccb8cd078f665ec8
commit: 56a06bd40fab64448aa6b84aa06b3dc470c1254a virtio_net: enable gso over UDP tunnel support.
date: 6 months ago
config: parisc-randconfig-002-20251230 (https://download.01.org/0day-ci/archive/20251230/202512301705.ho4pVldQ-lkp@intel.com/config)
compiler: hppa-linux-gcc (GCC) 8.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251230/202512301705.ho4pVldQ-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512301705.ho4pVldQ-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/net/virtio_net.c: In function 'virtnet_probe':
>> drivers/net/virtio_net.c:6492:36: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
sprintf(vi->rq[i].name, "input.%u", i);
^
drivers/net/virtio_net.c:6492:3: note: 'sprintf' output between 8 and 17 bytes into a destination of size 16
sprintf(vi->rq[i].name, "input.%u", i);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/virtio_net.c:6493:35: warning: '%u' directive writing between 1 and 10 bytes into a region of size 9 [-Wformat-overflow=]
sprintf(vi->sq[i].name, "output.%u", i);
^~
drivers/net/virtio_net.c:6493:27: note: directive argument in the range [0, 2147483647]
sprintf(vi->sq[i].name, "output.%u", i);
^~~~~~~~~~~
drivers/net/virtio_net.c:6493:3: note: 'sprintf' output between 9 and 18 bytes into a destination of size 16
sprintf(vi->sq[i].name, "output.%u", i);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/sprintf +6492 drivers/net/virtio_net.c
d85b758f72b05a Michael S. Tsirkin 2017-03-09 6451
986a4f4d452dec Jason Wang 2012-12-07 6452 static int virtnet_find_vqs(struct virtnet_info *vi)
3f9c10b0d478a3 Amit Shah 2011-12-22 6453 {
c2c6325e1645b5 Jiri Pirko 2024-07-08 6454 struct virtqueue_info *vqs_info;
986a4f4d452dec Jason Wang 2012-12-07 6455 struct virtqueue **vqs;
e3fe8d28c67bf6 Zhu Yanjun 2024-01-04 6456 int ret = -ENOMEM;
e3fe8d28c67bf6 Zhu Yanjun 2024-01-04 6457 int total_vqs;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6458 bool *ctx;
e3fe8d28c67bf6 Zhu Yanjun 2024-01-04 6459 u16 i;
986a4f4d452dec Jason Wang 2012-12-07 6460
986a4f4d452dec Jason Wang 2012-12-07 6461 /* We expect 1 RX virtqueue followed by 1 TX virtqueue, followed by
986a4f4d452dec Jason Wang 2012-12-07 6462 * possible N-1 RX/TX queue pairs used in multiqueue mode, followed by
986a4f4d452dec Jason Wang 2012-12-07 6463 * possible control vq.
986a4f4d452dec Jason Wang 2012-12-07 6464 */
986a4f4d452dec Jason Wang 2012-12-07 6465 total_vqs = vi->max_queue_pairs * 2 +
986a4f4d452dec Jason Wang 2012-12-07 6466 virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ);
986a4f4d452dec Jason Wang 2012-12-07 6467
986a4f4d452dec Jason Wang 2012-12-07 6468 /* Allocate space for find_vqs parameters */
6396bb221514d2 Kees Cook 2018-06-12 6469 vqs = kcalloc(total_vqs, sizeof(*vqs), GFP_KERNEL);
986a4f4d452dec Jason Wang 2012-12-07 6470 if (!vqs)
986a4f4d452dec Jason Wang 2012-12-07 6471 goto err_vq;
c2c6325e1645b5 Jiri Pirko 2024-07-08 6472 vqs_info = kcalloc(total_vqs, sizeof(*vqs_info), GFP_KERNEL);
c2c6325e1645b5 Jiri Pirko 2024-07-08 6473 if (!vqs_info)
c2c6325e1645b5 Jiri Pirko 2024-07-08 6474 goto err_vqs_info;
192f68cf35f5ee Jason Wang 2017-07-19 6475 if (!vi->big_packets || vi->mergeable_rx_bufs) {
6396bb221514d2 Kees Cook 2018-06-12 6476 ctx = kcalloc(total_vqs, sizeof(*ctx), GFP_KERNEL);
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6477 if (!ctx)
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6478 goto err_ctx;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6479 } else {
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6480 ctx = NULL;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6481 }
986a4f4d452dec Jason Wang 2012-12-07 6482
986a4f4d452dec Jason Wang 2012-12-07 6483 /* Parameters for control virtqueue, if any */
986a4f4d452dec Jason Wang 2012-12-07 6484 if (vi->has_cvq) {
c2c6325e1645b5 Jiri Pirko 2024-07-08 6485 vqs_info[total_vqs - 1].name = "control";
986a4f4d452dec Jason Wang 2012-12-07 6486 }
986a4f4d452dec Jason Wang 2012-12-07 6487
986a4f4d452dec Jason Wang 2012-12-07 6488 /* Allocate/initialize parameters for send/receive virtqueues */
986a4f4d452dec Jason Wang 2012-12-07 6489 for (i = 0; i < vi->max_queue_pairs; i++) {
c2c6325e1645b5 Jiri Pirko 2024-07-08 6490 vqs_info[rxq2vq(i)].callback = skb_recv_done;
c2c6325e1645b5 Jiri Pirko 2024-07-08 6491 vqs_info[txq2vq(i)].callback = skb_xmit_done;
e3fe8d28c67bf6 Zhu Yanjun 2024-01-04 @6492 sprintf(vi->rq[i].name, "input.%u", i);
e3fe8d28c67bf6 Zhu Yanjun 2024-01-04 6493 sprintf(vi->sq[i].name, "output.%u", i);
c2c6325e1645b5 Jiri Pirko 2024-07-08 6494 vqs_info[rxq2vq(i)].name = vi->rq[i].name;
c2c6325e1645b5 Jiri Pirko 2024-07-08 6495 vqs_info[txq2vq(i)].name = vi->sq[i].name;
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6496 if (ctx)
c2c6325e1645b5 Jiri Pirko 2024-07-08 6497 vqs_info[rxq2vq(i)].ctx = true;
986a4f4d452dec Jason Wang 2012-12-07 6498 }
986a4f4d452dec Jason Wang 2012-12-07 6499
6c85d6b653caeb Jiri Pirko 2024-07-08 6500 ret = virtio_find_vqs(vi->vdev, total_vqs, vqs, vqs_info, NULL);
986a4f4d452dec Jason Wang 2012-12-07 6501 if (ret)
986a4f4d452dec Jason Wang 2012-12-07 6502 goto err_find;
3f9c10b0d478a3 Amit Shah 2011-12-22 6503
986a4f4d452dec Jason Wang 2012-12-07 6504 if (vi->has_cvq) {
986a4f4d452dec Jason Wang 2012-12-07 6505 vi->cvq = vqs[total_vqs - 1];
986a4f4d452dec Jason Wang 2012-12-07 6506 if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VLAN))
f646968f8f7c62 Patrick McHardy 2013-04-19 6507 vi->dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
986a4f4d452dec Jason Wang 2012-12-07 6508 }
3f9c10b0d478a3 Amit Shah 2011-12-22 6509
986a4f4d452dec Jason Wang 2012-12-07 6510 for (i = 0; i < vi->max_queue_pairs; i++) {
986a4f4d452dec Jason Wang 2012-12-07 6511 vi->rq[i].vq = vqs[rxq2vq(i)];
d85b758f72b05a Michael S. Tsirkin 2017-03-09 6512 vi->rq[i].min_buf_len = mergeable_min_buf_len(vi, vi->rq[i].vq);
986a4f4d452dec Jason Wang 2012-12-07 6513 vi->sq[i].vq = vqs[txq2vq(i)];
986a4f4d452dec Jason Wang 2012-12-07 6514 }
3f9c10b0d478a3 Amit Shah 2011-12-22 6515
2fa3c8a8b23041 Tonghao Zhang 2018-05-31 6516 /* run here: ret == 0. */
3f9c10b0d478a3 Amit Shah 2011-12-22 6517
3f9c10b0d478a3 Amit Shah 2011-12-22 6518
986a4f4d452dec Jason Wang 2012-12-07 6519 err_find:
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6520 kfree(ctx);
d45b897b11eaf9 Michael S. Tsirkin 2017-03-06 6521 err_ctx:
c2c6325e1645b5 Jiri Pirko 2024-07-08 6522 kfree(vqs_info);
c2c6325e1645b5 Jiri Pirko 2024-07-08 6523 err_vqs_info:
986a4f4d452dec Jason Wang 2012-12-07 6524 kfree(vqs);
986a4f4d452dec Jason Wang 2012-12-07 6525 err_vq:
986a4f4d452dec Jason Wang 2012-12-07 6526 return ret;
3f9c10b0d478a3 Amit Shah 2011-12-22 6527 }
986a4f4d452dec Jason Wang 2012-12-07 6528
:::::: The code at line 6492 was first introduced by commit
:::::: e3fe8d28c67bf6c291e920c6d04fa22afa14e6e4 virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
:::::: TO: Zhu Yanjun <yanjun.zhu@...ux.dev>
:::::: CC: Jakub Kicinski <kuba@...nel.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists