netdev - Re: [PATCH ethtool] netlink: fix print

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lwicuyi63qrip45nfwhifujhgtravqojbv4sud5acdqpmn7tpi@7ghj23b3hhdx>
Date: Fri, 8 Aug 2025 01:05:52 +0200
From: Michal Kubecek <mkubecek@...e.cz>
To: Michel Lind <michel@...hel-slm.name>
Cc: netdev@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH ethtool] netlink: fix print_string when the value is NULL

On Thu, Jul 24, 2025 at 07:48:11PM GMT, Michel Lind wrote:
> The previous fix in commit b70c92866102 ("netlink: fix missing headers
> in text output") handles the case when value is NULL by still using
> `fprintf` but passing no value.
> 
> This fails if `-Werror=format-security` is passed to gcc, as is the
> default in distros like Fedora.
> 
> ```
> json_print.c: In function 'print_string':
> json_print.c:147:25: error: format not a string literal and no format arguments [-Werror=format-security]
>   147 |                         fprintf(stdout, fmt);
>       |
> ```
> 
> Use `fprintf(stdout, "%s", fmt)` instead, using the format string as the
> value, since in this case we know it is just a string without format
> chracters.
> 
> Reviewed-by: Jakub Kicinski <kuba@...nel.org>
> Signed-off-by: Michel Lind <michel@...hel-slm.name>

Applied, thank you.

It's a bit surprising that I didn't hit this problem as I always test
building with "-Wall -Wextra -Werror". I suppose this option is not
contained in -Wall or -Wextra.

Michal

> ---
>  json_print.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/json_print.c b/json_print.c
> index e07c651..75e6cd9 100644
> --- a/json_print.c
> +++ b/json_print.c
> @@ -144,7 +144,7 @@ void print_string(enum output_type type,
>  		if (value)
>  			fprintf(stdout, fmt, value);
>  		else
> -			fprintf(stdout, fmt);
> +			fprintf(stdout, "%s", fmt);
>  	}
>  }
>  
> -- 
> 2.50.1
> 
> 
> -- 
>  _o) Michel Lind
> _( ) identities: https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
>      README:     https://fedoraproject.org/wiki/User:Salimma#README



Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)