[PATCH] net/ixgbe/base: fix string truncation warning in ACI debug dump

[PATCH] net/ixgbe/base: fix string truncation warning in ACI debug dump

[Stephen Hemminger]

Building with ASAN and -Werror fails:

  ixgbe_e610.c:59:41: error: 'strncat' output may be truncated
  copying between 43 and 118 bytes from a string of length 127
  [-Werror=stringop-truncation]

The hex dump used snprintf into a scratch buffer followed by strncat
with a signed remaining-space count, which could also go negative and
be passed to strncat as a huge size_t. Format each row directly with
snprintf at an offset instead, and handle the partial last row in the
same loop.

Fixes: 12648d0a5afc ("net/ixgbe/base: add admin interface debug printouts")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/intel/ixgbe/base/ixgbe_e610.c | 48 +++++++----------------
 1 file changed, 15 insertions(+), 33 deletions(-)

diff --git a/drivers/net/intel/ixgbe/base/ixgbe_e610.c b/drivers/net/intel/ixgbe/base/ixgbe_e610.c
index 06a69d1d62..dc5e668edc 100644
--- a/drivers/net/intel/ixgbe/base/ixgbe_e610.c
+++ b/drivers/net/intel/ixgbe/base/ixgbe_e610.c
@@ -42,41 +42,23 @@ void ixgbe_shutdown_aci(struct ixgbe_hw *hw)
 STATIC void ixgbe_aci_debug_array(struct ixgbe_hw *hw, u16 row_size, u8 *buf,
 				  u16 buf_size)
 {
-	char debug_portion[IXGBE_ACI_MAX_DEBUG_STRING_LENGTH] = {'\0'};
-	char debug_string[IXGBE_ACI_MAX_DEBUG_STRING_LENGTH] = {'\0'};
-	u16 i = 0, j = 0;
-	s16 remaining_space = IXGBE_ACI_MAX_DEBUG_STRING_LENGTH - 1;
-	s16 nbytes = 0;
-	if (!hw)
+	char line[IXGBE_ACI_MAX_DEBUG_STRING_LENGTH];
+	u32 i, j;
+
+	if (!hw || !buf || !row_size)
 		return;
-	if (buf && buf_size && row_size) {
-		if (buf_size >= row_size) {
-			for (i = 0; i < (buf_size - row_size); i += row_size) {
-				nbytes = snprintf(debug_string, sizeof(debug_string), "0x%04X : ", i);
-				remaining_space = IXGBE_ACI_MAX_DEBUG_STRING_LENGTH - nbytes - 1;
-				for (j = 0; j < row_size; j++) {
-					nbytes = snprintf(debug_portion, sizeof(debug_portion), "0x%02X ", buf[i + j]);
-					strncat(debug_string, debug_portion, remaining_space);
-					remaining_space -= nbytes;
-					if (remaining_space <= 0) break;
-				}
-				strncat(debug_string, "\n", remaining_space);
-				DEBUGOUT1("%s", debug_string);
-				memset(debug_string, 0, IXGBE_ACI_MAX_DEBUG_STRING_LENGTH);
-			}
-		}
-		if (i < buf_size) {
-			nbytes = snprintf(debug_string, sizeof(debug_string), "0x%04X : ", i);
-			remaining_space = IXGBE_ACI_MAX_DEBUG_STRING_LENGTH - nbytes - 1;
-			for (j = 0; j < (buf_size - i); j++) {
-				nbytes = snprintf(debug_portion, sizeof(debug_portion), "0x%02X ", buf[i + j]);
-				strncat(debug_string, debug_portion, remaining_space);
-				remaining_space -= nbytes;
-				if (remaining_space <= 0) break;
-			}
-			strncat(debug_string, "\n", remaining_space);
-			DEBUGOUT1("%s", debug_string);
+
+	for (i = 0; i < buf_size; i += row_size) {
+		size_t len;
+
+		len = snprintf(line, sizeof(line), "0x%04X : ", i);
+		for (j = 0; j < row_size && i + j < buf_size; j++) {
+			if (len >= sizeof(line))
+				break;
+			len += snprintf(line + len, sizeof(line) - len,
+					"0x%02X ", buf[i + j]);
 		}
+		DEBUGOUT1("%s\n", line);
 	}
 }
 
-- 
2.53.0