From: Johan Hovold <johan@kernel.org> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Johan Hovold <johan@kernel.org>, Alex Elder <elder@kernel.org>, Axel Haslam <ahaslam@baylibre.com>, Bryan ODonoghue <pure.logic@nexus-software.ie>, greybus-dev@lists.linaro.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/3] staging: greybus: loopback_test: fix potential path truncation Date: Thu, 12 Mar 2020 12:01:50 +0100 [thread overview] Message-ID: <20200312110151.22028-3-johan@kernel.org> (raw) In-Reply-To: <20200312110151.22028-1-johan@kernel.org> Newer GCC warns about a possible truncation of a generated sysfs path name as we're concatenating a directory path with a file name and placing the result in a buffer that is half the size of the maximum length of the directory path (which is user controlled). loopback_test.c: In function 'open_poll_files': loopback_test.c:651:31: warning: '%s' directive output may be truncated writing up to 511 bytes into a region of size 255 [-Wformat-truncation=] 651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count"); | ^~ loopback_test.c:651:3: note: 'snprintf' output between 16 and 527 bytes into a destination of size 255 651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count"); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by making sure the buffer is large enough the concatenated strings. Fixes: 6b0658f68786 ("greybus: tools: Add tools directory to greybus repo and add loopback") Fixes: 9250c0ee2626 ("greybus: Loopback_test: use poll instead of inotify") Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/staging/greybus/tools/loopback_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c index 41e1820d9ac9..d38bb4fbd6b9 100644 --- a/drivers/staging/greybus/tools/loopback_test.c +++ b/drivers/staging/greybus/tools/loopback_test.c @@ -637,7 +637,7 @@ int find_loopback_devices(struct loopback_test *t) static int open_poll_files(struct loopback_test *t) { struct loopback_device *dev; - char buf[MAX_STR_LEN]; + char buf[MAX_SYSFS_PATH + MAX_STR_LEN]; char dummy; int fds_idx = 0; int i; -- 2.24.1
WARNING: multiple messages have this Message-ID (diff)
From: Johan Hovold <johan@kernel.org> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: devel@driverdev.osuosl.org, Alex Elder <elder@kernel.org>, Axel Haslam <ahaslam@baylibre.com>, Johan Hovold <johan@kernel.org>, linux-kernel@vger.kernel.org, greybus-dev@lists.linaro.org Subject: [PATCH 2/3] staging: greybus: loopback_test: fix potential path truncation Date: Thu, 12 Mar 2020 12:01:50 +0100 [thread overview] Message-ID: <20200312110151.22028-3-johan@kernel.org> (raw) In-Reply-To: <20200312110151.22028-1-johan@kernel.org> Newer GCC warns about a possible truncation of a generated sysfs path name as we're concatenating a directory path with a file name and placing the result in a buffer that is half the size of the maximum length of the directory path (which is user controlled). loopback_test.c: In function 'open_poll_files': loopback_test.c:651:31: warning: '%s' directive output may be truncated writing up to 511 bytes into a region of size 255 [-Wformat-truncation=] 651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count"); | ^~ loopback_test.c:651:3: note: 'snprintf' output between 16 and 527 bytes into a destination of size 255 651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count"); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by making sure the buffer is large enough the concatenated strings. Fixes: 6b0658f68786 ("greybus: tools: Add tools directory to greybus repo and add loopback") Fixes: 9250c0ee2626 ("greybus: Loopback_test: use poll instead of inotify") Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/staging/greybus/tools/loopback_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c index 41e1820d9ac9..d38bb4fbd6b9 100644 --- a/drivers/staging/greybus/tools/loopback_test.c +++ b/drivers/staging/greybus/tools/loopback_test.c @@ -637,7 +637,7 @@ int find_loopback_devices(struct loopback_test *t) static int open_poll_files(struct loopback_test *t) { struct loopback_device *dev; - char buf[MAX_STR_LEN]; + char buf[MAX_SYSFS_PATH + MAX_STR_LEN]; char dummy; int fds_idx = 0; int i; -- 2.24.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
next prev parent reply other threads:[~2020-03-12 11:02 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-03-12 11:01 [PATCH 0/3] staging: greybus: loopback_test: fix build breakage Johan Hovold 2020-03-12 11:01 ` Johan Hovold 2020-03-12 11:01 ` [PATCH 1/3] staging: greybus: loopback_test: fix poll-mask " Johan Hovold 2020-03-12 11:01 ` Johan Hovold 2020-03-12 11:01 ` Johan Hovold [this message] 2020-03-12 11:01 ` [PATCH 2/3] staging: greybus: loopback_test: fix potential path truncation Johan Hovold 2020-03-12 11:01 ` [PATCH 3/3] staging: greybus: loopback_test: fix potential path truncations Johan Hovold 2020-03-12 11:01 ` Johan Hovold
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200312110151.22028-3-johan@kernel.org \ --to=johan@kernel.org \ --cc=ahaslam@baylibre.com \ --cc=devel@driverdev.osuosl.org \ --cc=elder@kernel.org \ --cc=gregkh@linuxfoundation.org \ --cc=greybus-dev@lists.linaro.org \ --cc=linux-kernel@vger.kernel.org \ --cc=pure.logic@nexus-software.ie \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.