From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754149AbdGNMdf (ORCPT ); Fri, 14 Jul 2017 08:33:35 -0400 Received: from foss.arm.com ([217.140.101.70]:47746 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753486AbdGNMdd (ORCPT ); Fri, 14 Jul 2017 08:33:33 -0400 Subject: Re: [PATCH 11/22] net: thunder_bgx: avoid format string overflow warning To: Arnd Bergmann , linux-kernel@vger.kernel.org, Sunil Goutham , Robert Richter Cc: George Cherian , "James E . J . Bottomley" , linux-scsi@vger.kernel.org, "Martin K . Petersen" , Greg Kroah-Hartman , x86@kernel.org, Radha Mohan Chintakuntla , Vadim Lomovtsev , linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org, Thanneeru Srinivasulu , akpm@linux-foundation.org, Linus Torvalds , "David S . Miller" , Guenter Roeck References: <20170714120720.906842-1-arnd@arndb.de> <20170714120720.906842-12-arnd@arndb.de> From: Robin Murphy Message-ID: Date: Fri, 14 Jul 2017 13:33:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <20170714120720.906842-12-arnd@arndb.de> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 14/07/17 13:07, Arnd Bergmann wrote: > gcc warns that the temporary buffer might be too small here: > > drivers/net/ethernet/cavium/thunder/thunder_bgx.c: In function 'bgx_probe': > drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:16: error: '%d' directive writing between 1 and 10 bytes into a region of size between 9 and 11 [-Werror=format-overflow=] > sprintf(str, "BGX%d LMAC%d mode", bgx->bgx_id, lmacid); > ^~~~~~~~~~~~~~~~~~~ > drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:16: note: directive argument in the range [0, 2147483647] > drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:3: note: 'sprintf' output between 16 and 27 bytes into a destination of size 20 > > This probably can't happen, but it can't hurt to make it long > enough for the theoretical limit. Probably indeed - both bgx_id and lmacid are u8 here, which would make the maximum length of that string, including null terminator, exactly 20 characters. So in this case the warning is not only silly, it's actively wrong; sure, the arguments themselves are being promoted to ints at that point, but GCC *knows* the original type, or it couldn't have generated the correct code for the call :/ Robin. > Signed-off-by: Arnd Bergmann > --- > drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c > index a0ca68ce3fbb..79112563a25a 100644 > --- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c > +++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c > @@ -1008,7 +1008,7 @@ static void bgx_print_qlm_mode(struct bgx *bgx, u8 lmacid) > { > struct device *dev = &bgx->pdev->dev; > struct lmac *lmac; > - char str[20]; > + char str[27]; > > if (!bgx->is_dlm && lmacid) > return; > From mboxrd@z Thu Jan 1 00:00:00 1970 From: robin.murphy@arm.com (Robin Murphy) Date: Fri, 14 Jul 2017 13:33:28 +0100 Subject: [PATCH 11/22] net: thunder_bgx: avoid format string overflow warning In-Reply-To: <20170714120720.906842-12-arnd@arndb.de> References: <20170714120720.906842-1-arnd@arndb.de> <20170714120720.906842-12-arnd@arndb.de> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On 14/07/17 13:07, Arnd Bergmann wrote: > gcc warns that the temporary buffer might be too small here: > > drivers/net/ethernet/cavium/thunder/thunder_bgx.c: In function 'bgx_probe': > drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:16: error: '%d' directive writing between 1 and 10 bytes into a region of size between 9 and 11 [-Werror=format-overflow=] > sprintf(str, "BGX%d LMAC%d mode", bgx->bgx_id, lmacid); > ^~~~~~~~~~~~~~~~~~~ > drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:16: note: directive argument in the range [0, 2147483647] > drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:3: note: 'sprintf' output between 16 and 27 bytes into a destination of size 20 > > This probably can't happen, but it can't hurt to make it long > enough for the theoretical limit. Probably indeed - both bgx_id and lmacid are u8 here, which would make the maximum length of that string, including null terminator, exactly 20 characters. So in this case the warning is not only silly, it's actively wrong; sure, the arguments themselves are being promoted to ints at that point, but GCC *knows* the original type, or it couldn't have generated the correct code for the call :/ Robin. > Signed-off-by: Arnd Bergmann > --- > drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c > index a0ca68ce3fbb..79112563a25a 100644 > --- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c > +++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c > @@ -1008,7 +1008,7 @@ static void bgx_print_qlm_mode(struct bgx *bgx, u8 lmacid) > { > struct device *dev = &bgx->pdev->dev; > struct lmac *lmac; > - char str[20]; > + char str[27]; > > if (!bgx->is_dlm && lmacid) > return; >