Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

tsnep: Fix tsnep_request_irq() format-overflow warning

Compiler warns about a possible format-overflow in tsnep_request_irq():
drivers/net/ethernet/engleder/tsnep_main.c:884:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
sprintf(queue->name, "%s-rx-%d", name,
^
drivers/net/ethernet/engleder/tsnep_main.c:881:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
sprintf(queue->name, "%s-tx-%d", name,
^
drivers/net/ethernet/engleder/tsnep_main.c:878:49: warning: '-txrx-' directive writing 6 bytes into a region of size between 5 and 25 [-Wformat-overflow=]
sprintf(queue->name, "%s-txrx-%d", name,
^~~~~~

Actually overflow cannot happen. Name is limited to IFNAMSIZ, because
netdev_name() is called during ndo_open(). queue_index is single char,
because less than 10 queues are supported.

Fix warning with snprintf(). Additionally increase buffer to 32 bytes,
because those 7 additional bytes were unused anyway.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310182028.vmDthIUa-lkp@intel.com/
Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231023183856.58373-1-gerhard@engleder-embedded.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Gerhard Engleder and committed by
Jakub Kicinski
00e984cb fcc017e3

+7 -7
+1 -1
drivers/net/ethernet/engleder/tsnep.h
··· 143 143 144 144 struct tsnep_queue { 145 145 struct tsnep_adapter *adapter; 146 - char name[IFNAMSIZ + 9]; 146 + char name[IFNAMSIZ + 16]; 147 147 148 148 struct tsnep_tx *tx; 149 149 struct tsnep_rx *rx;
+6 -6
drivers/net/ethernet/engleder/tsnep_main.c
··· 1830 1830 dev = queue->adapter; 1831 1831 } else { 1832 1832 if (queue->tx && queue->rx) 1833 - sprintf(queue->name, "%s-txrx-%d", name, 1834 - queue->rx->queue_index); 1833 + snprintf(queue->name, sizeof(queue->name), "%s-txrx-%d", 1834 + name, queue->rx->queue_index); 1835 1835 else if (queue->tx) 1836 - sprintf(queue->name, "%s-tx-%d", name, 1837 - queue->tx->queue_index); 1836 + snprintf(queue->name, sizeof(queue->name), "%s-tx-%d", 1837 + name, queue->tx->queue_index); 1838 1838 else 1839 - sprintf(queue->name, "%s-rx-%d", name, 1840 - queue->rx->queue_index); 1839 + snprintf(queue->name, sizeof(queue->name), "%s-rx-%d", 1840 + name, queue->rx->queue_index); 1841 1841 handler = tsnep_irq_txrx; 1842 1842 dev = queue; 1843 1843 }