[PATCH v14 15/17] vhost: check for overflow in xstat name

Stephen Hemminger
2026-01-29T01:44:52Z

The snprintf to format an xstat name could overflow if called with
a long rte_vhost_stat_name. Check if that happens and warn.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
lib/vhost/vhost.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
index 416f082dca..540f4e0635 100644
--- a/lib/vhost/vhost.c
+++ b/lib/vhost/vhost.c
@@ -2200,6 +2200,7 @@ rte_vhost_vring_stats_get_names(int vid, uint16_t queue_id,
{
struct virtio_net *dev = get_device(vid);
unsigned int i;
+ int ret;

if (dev == NULL)
return -1;
@@ -2213,10 +2214,15 @@ rte_vhost_vring_stats_get_names(int vid, uint16_t queue_id,
if (name == NULL || size < VHOST_NB_VQ_STATS)
return VHOST_NB_VQ_STATS;

- for (i = 0; i < VHOST_NB_VQ_STATS; i++)
- snprintf(name[i].name, sizeof(name[i].name), "%s_q%u_%s",
- (queue_id & 1) ? "rx" : "tx",
- queue_id / 2, vhost_vq_stat_strings[i].name);
+ for (i = 0; i < VHOST_NB_VQ_STATS; i++) {
+ ret = snprintf(name[i].name, sizeof(name[i].name), "%s_q%u_%s",
+ (queue_id & 1) ? "rx" : "tx",
+ queue_id / 2, vhost_vq_stat_strings[i].name);
+ if (ret >= (int)sizeof(name[0].name))
+ VHOST_CONFIG_LOG("device", NOTICE, "truncated xstat '%s_q%u_%s'",
+ (queue_id & 1) ? "rx" : "tx",
+ queue_id / 2, vhost_vq_stat_strings[i].name);
+ }

return VHOST_NB_VQ_STATS;
}
--
2.51.0