netdev - Re: [PATCH net-next] tsnep: Fix tsnep_request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <28ab31a4-b576-4f08-a522-54756c6bda9c@intel.com>
Date: Mon, 23 Oct 2023 17:31:36 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Gerhard Engleder <gerhard@...leder-embedded.com>, <netdev@...r.kernel.org>
CC: <davem@...emloft.net>, <kuba@...nel.org>, <edumazet@...gle.com>,
	<pabeni@...hat.com>, kernel test robot <lkp@...el.com>
Subject: Re: [PATCH net-next] tsnep: Fix tsnep_request_irq() format-overflow
 warning



On 10/23/2023 11:38 AM, Gerhard Engleder wrote:
> Compiler warns about a possible format-overflow in tsnep_request_irq():
> drivers/net/ethernet/engleder/tsnep_main.c:884:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
>                          sprintf(queue->name, "%s-rx-%d", name,
>                                                        ^
> drivers/net/ethernet/engleder/tsnep_main.c:881:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
>                          sprintf(queue->name, "%s-tx-%d", name,
>                                                        ^
> drivers/net/ethernet/engleder/tsnep_main.c:878:49: warning: '-txrx-' directive writing 6 bytes into a region of size between 5 and 25 [-Wformat-overflow=]
>                          sprintf(queue->name, "%s-txrx-%d", name,
>                                                  ^~~~~~
> 
> Actually overflow cannot happen. Name is limited to IFNAMSIZ, because
> netdev_name() is called during ndo_open(). queue_index is single char,
> because less than 10 queues are supported.
> 
> Fix warning with snprintf(). Additionally increase buffer to 32 bytes,
> because those 7 additional bytes were unused anyway.
> 

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>