netdev - Re: [Intel-wired-lan] [PATCH] i40e: replace snprintf() with scnprintf()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <38c52f32-cca9-4458-a285-33bc142d58c1@intel.com>
Date: Tue, 22 Jul 2025 16:27:56 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Tony Nguyen <anthony.l.nguyen@...el.com>, Amir Mohammad Jahangirzad
	<a.jahangirzad@...il.com>, <przemyslaw.kitszel@...el.com>,
	<andrew+netdev@...n.ch>, <davem@...emloft.net>, <edumazet@...gle.com>,
	<kuba@...nel.org>, <pabeni@...hat.com>
CC: <intel-wired-lan@...ts.osuosl.org>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [Intel-wired-lan] [PATCH] i40e: replace snprintf() with
 scnprintf()



On 7/22/2025 1:17 PM, Tony Nguyen wrote:
> 
> 
> On 7/22/2025 4:50 AM, Amir Mohammad Jahangirzad wrote:
>> In i40e_dbg_command_read(), a 256-byte buffer is allocated and filled
>> using snprintf(), then copied to userspace via copy_to_user().
>>
>> The issue is that snprintf() returns the number of characters that
>> *Would* have been written, not the number that actually fit in the buffer.
>> If the combined length of the netdev name and i40e_dbg_command_buf is
>> long (e.g. 288 + 3 bytes), snprintf() still returns 291 - even though only
>> 256 bytes were written.
> 
> Hi Amir,
> 
> Thank you for the patch. In practice, this won't overflow [1]. However, 
> this code can be improved. If you follow the thread, there's 
> conversation of the changes that will be made.
> 
> Thanks,
> Tony
> 
> [1] https://lore.kernel.org/netdev/20250714181032.GS721198@horms.kernel.org/
> 

Yep. I have patches to just remove this read interface entirely. I hope
to post them later today.


Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)