netdev - Re: [PATCH] net: dsa: realtek: rtl8365mb: replace deprecated strncpy with ethtool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231010220643.w5wmaftubiv7yo7t@skbuf>
Date: Wed, 11 Oct 2023 01:06:43 +0300
From: Vladimir Oltean <olteanv@...il.com>
To: Justin Stitt <justinstitt@...gle.com>
Cc: Linus Walleij <linus.walleij@...aro.org>,
	Alvin Šipraga <alsi@...g-olufsen.dk>,
	Andrew Lunn <andrew@...n.ch>,
	Florian Fainelli <f.fainelli@...il.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org
Subject: Re: [PATCH] net: dsa: realtek: rtl8365mb: replace deprecated strncpy
 with ethtool_sprintf

On Tue, Oct 10, 2023 at 02:48:07PM -0700, Justin Stitt wrote:
> On Tue, Oct 10, 2023 at 10:36 AM Justin Stitt <justinstitt@...gle.com> wrote:
> > > Is there any particular reason why you opted for the "%s" printf format
> > > specifier when you could have simply given mib->name as the single
> > > argument? This comment applies to all the ethtool_sprintf() patches
> > > you've submitted.
> >
> > Yeah, it causes a -Wformat-security warning for me. I briefly mentioned it
> > in one of my first patches like this [1].
> 
> For more context, here's some warnings in the wild:
> https://lore.kernel.org/netdev/20231003183603.3887546-3-jesse.brandeburg@intel.com/
> 
> >
> > [1]: https://lore.kernel.org/all/20231005-strncpy-drivers-net-dsa-lan9303-core-c-v2-1-feb452a532db@google.com/

Yeah, ok. It's a false positive warning, but I guess it would be too
hard for the compiler to figure that out.