[PATCH] Input: sidewinder - size the name buffers to their formats

[PATCH] Input: sidewinder - size the name buffers to their formats

[xujiahao]

sw_connect() composes the physical path of each port as "%s/input%d"
from gameport->phys into a 32-byte array.  gameport->phys is a 32-byte
string and the port number is an int, so the worst case is 31 + 6 + 10
characters plus the terminator and does not fit.

sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte
comment buffer of sw_connect().  The PnP ID is 7 characters, the
revision string 8, and the %d arguments are a full-range int as far as
the compiler can tell, so 44 characters plus the terminator do not fit
either.

Size both buffers to their formats.  Truncation is theoretical with the
values seen today, but a buffer should not be smaller than what it is
asked to hold.  Building with W=1:

  drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
  drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]

Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
 drivers/input/joystick/sidewinder.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 7f37d18c8..2bd5cfe5c 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -97,7 +97,7 @@ struct sw {
 	struct gameport *gameport;
 	struct input_dev *dev[4];
 	char name[64];
-	char phys[4][32];
+	char phys[4][64];
 	int length;
 	int type;
 	int bits;
@@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
 	unsigned char *buf = NULL;	/* [SW_LENGTH] */
 	unsigned char *idbuf = NULL;	/* [SW_LENGTH] */
 	unsigned char m = 1;
-	char comment[40];
+	char comment[48];
 
 	comment[0] = 0;
 
-- 
2.43.0

Re: [PATCH] Input: sidewinder - size the name buffers to their formats

[Dmitry Torokhov]

On Fri, Nov 06, 2026 at 11:33:00AM +0800, xujiahao wrote:
> sw_connect() composes the physical path of each port as "%s/input%d"
> from gameport->phys into a 32-byte array.  gameport->phys is a 32-byte
> string and the port number is an int, so the worst case is 31 + 6 + 10
> characters plus the terminator and does not fit.
> 
> sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte
> comment buffer of sw_connect().  The PnP ID is 7 characters, the
> revision string 8, and the %d arguments are a full-range int as far as
> the compiler can tell, so 44 characters plus the terminator do not fit
> either.
> 
> Size both buffers to their formats.  Truncation is theoretical with the
> values seen today, but a buffer should not be smaller than what it is
> asked to hold.  Building with W=1:
> 
>   drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
>   drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
> 
> Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
> ---
>  drivers/input/joystick/sidewinder.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
> index 7f37d18c8..2bd5cfe5c 100644
> --- a/drivers/input/joystick/sidewinder.c
> +++ b/drivers/input/joystick/sidewinder.c
> @@ -97,7 +97,7 @@ struct sw {
>  	struct gameport *gameport;
>  	struct input_dev *dev[4];
>  	char name[64];
> -	char phys[4][32];
> +	char phys[4][64];
>  	int length;
>  	int type;
>  	int bits;
> @@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
>  	unsigned char *buf = NULL;	/* [SW_LENGTH] */
>  	unsigned char *idbuf = NULL;	/* [SW_LENGTH] */
>  	unsigned char m = 1;
> -	char comment[40];
> +	char comment[48];

This just wastes memory for something that never happens. We are OK even
if data is truncated.

To shut off the warnings I think we can switch to scnprintf().

Thanks.

-- 
Dmitry

[PATCH v2] Input: sidewinder - use scnprintf() for the port names

[xujiahao]

sw_connect() composes the physical path of each port as "%s/input%d"
from gameport->phys into a 32-byte array, and sw_3dp_id() builds
" [PnP %d.%02d id %s rev %s]" into the 40-byte comment buffer of
sw_connect().  GCC reports that both formats can overflow their buffers
in a W=1 build:

  drivers/input/joystick/sidewinder.c:538:58: warning: ‘%s’ directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
  drivers/input/joystick/sidewinder.c:727:29: warning: ‘/input’ directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]

The values seen in practice fit these buffers, and a truncated name is
harmless, so keep the sizes as they are and switch to scnprintf() to
make the truncation explicit instead of letting the compiler warn about
a possible one.

Link: https://lore.kernel.org/all/20261106033300.3439313-1-xujiahao@cmss.chinamobile.com/
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
 drivers/input/joystick/sidewinder.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 7f37d18c8..bca81df19 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -535,12 +535,12 @@ static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
 
 	pnp[7] = rev[8] = 0;
 
-	snprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
-		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |		/* Two 6-bit values */
-			sw_get_bits(buf, 16, 6, 1)) / 100,
-		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |
-			sw_get_bits(buf, 16, 6, 1)) % 100,
-		 pnp, rev);
+	scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
+		  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |	/* Two 6-bit values */
+			  sw_get_bits(buf, 16, 6, 1)) / 100),
+		  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |
+			  sw_get_bits(buf, 16, 6, 1)) % 100),
+		  pnp, rev);
 }
 
 /*
@@ -723,8 +723,8 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
 
 		snprintf(sw->name, sizeof(sw->name),
 			 "Microsoft SideWinder %s", sw_name[sw->type]);
-		snprintf(sw->phys[i], sizeof(sw->phys[i]),
-			 "%s/input%d", gameport->phys, i);
+		scnprintf(sw->phys[i], sizeof(sw->phys[i]),
+			  "%s/input%d", gameport->phys, i);
 
 		sw->dev[i] = input_dev = input_allocate_device();
 		if (!input_dev) {
-- 
2.43.0

Re: [PATCH v2] Input: sidewinder - use scnprintf() for the port names

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] Input: sidewinder - 64-bit division in sw_3dp_id() breaks
  32-bit builds
--

commit 126f9830817fff924c0c3fe1b867c22b8b4a2692
Author: xujiahao <xujiahao@cmss.chinamobile.com>

Input: sidewinder - use scnprintf() for the port names

This commit switches sw_3dp_id() and sw_connect() from snprintf() to
scnprintf() to silence -Wformat-truncation warnings.

Link: https://lore.kernel.org/all/20261106033300.3439313-1-xujiahao@cmss.chinamobile.com/

> diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
> index 7f37d18c8477a..bca81df19da44 100644
> --- a/drivers/input/joystick/sidewinder.c
> +++ b/drivers/input/joystick/sidewinder.c
> @@ -535,12 +535,12 @@ static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
>  
>  	pnp[7] = rev[8] = 0;
>  
> -	snprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
> -		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |		/* Two 6-bit values */
> -			sw_get_bits(buf, 16, 6, 1)) / 100,
> -		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |
> -			sw_get_bits(buf, 16, 6, 1)) % 100,
> -		 pnp, rev);
> +	scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
> +		  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |	/* Two 6-bit values */
> +			  sw_get_bits(buf, 16, 6, 1)) / 100),
> +		  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |
> +			  sw_get_bits(buf, 16, 6, 1)) % 100),
> +		  pnp, rev);
>  }

[Severity: High]
Does wrapping `/ 100` and `% 100` inside the `(int)` cast break the build on
32-bit architectures?

sw_get_bits() returns `__u64`.  Previously, the `(int)` cast truncated the
bitwise OR result before dividing by 100, whereas moving the outer
parentheses around `/ 100` and `% 100` turns them into 64-bit unsigned
division and modulo, emitting undefined references to `__udivdi3` and
`__umoddi3` (or `__aeabi_uldivmod`) at link time on 32-bit targets.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109010548.438699-1-xujiahao@cmss.chinamobile.com?part=1

Re: [PATCH v2] Input: sidewinder - use scnprintf() for the port names

[kernel test robot]

Hi xujiahao,

kernel test robot noticed the following build errors:

[auto build test ERROR on dtor-input/next]
[also build test ERROR on dtor-input/for-linus hid/for-next linus/master v7.4-rc2 next-20261105]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/xujiahao/Input-sidewinder-use-scnprintf-for-the-port-names/20261109-090548
base:   https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
patch link:    https://lore.kernel.org/r/20261109010548.438699-1-xujiahao%40cmss.chinamobile.com
patch subject: [PATCH v2] Input: sidewinder - use scnprintf() for the port names
config: arm-randconfig-1000-20261109 (https://download.01.org/0day-ci/archive/20261109/202611091814.ChpgVgpE-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261109/202611091814.ChpgVgpE-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611091814.ChpgVgpE-lkp@intel.com/

All errors (new ones prefixed by >>):

   arm-linux-gnueabi-ld: drivers/input/joystick/sidewinder.o: in function `sw_3dp_id.constprop.0':
>> sidewinder.c:(.text+0xa52): undefined reference to `__aeabi_uldivmod'
>> arm-linux-gnueabi-ld: sidewinder.c:(.text+0xa66): undefined reference to `__aeabi_uldivmod'

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2] Input: sidewinder - use scnprintf() for the port names

[kernel test robot]

Hi xujiahao,

kernel test robot noticed the following build errors:

[auto build test ERROR on dtor-input/next]
[also build test ERROR on dtor-input/for-linus hid/for-next linus/master v7.4-rc2 next-20261109]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/xujiahao/Input-sidewinder-use-scnprintf-for-the-port-names/20261109-090548
base:   https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
patch link:    https://lore.kernel.org/r/20261109010548.438699-1-xujiahao%40cmss.chinamobile.com
patch subject: [PATCH v2] Input: sidewinder - use scnprintf() for the port names
config: i386-randconfig-1006-20261109 (https://download.01.org/0day-ci/archive/20261110/202611100328.QAelfSpD-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261110/202611100328.QAelfSpD-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611100328.QAelfSpD-lkp@intel.com/

All errors (new ones prefixed by >>):

   ld: drivers/input/joystick/sidewinder.o: in function `sw_3dp_id':
>> drivers/input/joystick/sidewinder.c:542:(.text+0x1630): undefined reference to `__umoddi3'
>> ld: drivers/input/joystick/sidewinder.c:540:(.text+0x1652): undefined reference to `__udivdi3'


vim +542 drivers/input/joystick/sidewinder.c

   519	
   520	/*
   521	 * sw_3dp_id() translates the 3DP id into a human legible string.
   522	 * Unfortunately I don't know how to do this for the other SW types.
   523	 */
   524	
   525	static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
   526	{
   527		int i;
   528		char pnp[8], rev[9];
   529	
   530		for (i = 0; i < 7; i++)						/* ASCII PnP ID */
   531			pnp[i] = sw_get_bits(buf, 24+8*i, 8, 1);
   532	
   533		for (i = 0; i < 8; i++)						/* ASCII firmware revision */
   534			rev[i] = sw_get_bits(buf, 88+8*i, 8, 1);
   535	
   536		pnp[7] = rev[8] = 0;
   537	
   538		scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
   539			  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |	/* Two 6-bit values */
 > 540				  sw_get_bits(buf, 16, 6, 1)) / 100),
   541			  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |
 > 542				  sw_get_bits(buf, 16, 6, 1)) % 100),
   543			  pnp, rev);
   544	}
   545	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH v3] Input: sidewinder - use scnprintf() for the port names

[xujiahao]

sw_connect() composes the physical path of each port as "%s/input%d"
from gameport->phys into a 32-byte array, and sw_3dp_id() builds
" [PnP %d.%02d id %s rev %s]" into the 40-byte comment buffer of
sw_connect().  GCC reports that both formats can overflow their buffers
in a W=1 build:

  drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
  drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]

The values seen in practice fit these buffers, and a truncated name is
harmless, so keep the sizes as they are and switch to scnprintf() to
make the truncation explicit instead of letting the compiler warn about
a possible one.

Link: https://lore.kernel.org/all/20261106033300.3439313-1-xujiahao@cmss.chinamobile.com/
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202611091814.ChpgVgpE-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202611100328.QAelfSpD-lkp@intel.com/
Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
v3:
 - The PnP id computation is untouched again.  v2 moved the (int) cast
   behind the division, which made it a 64-bit division and broke 32-bit
   builds (ld: undefined reference to __aeabi_uldivmod / __udivdi3 /
   __umoddi3), as reported by the kernel test robot.  Only the snprintf()
   calls change now.
---
 drivers/input/joystick/sidewinder.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 7f37d18c8..78dc70964 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -535,12 +535,12 @@ static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
 
 	pnp[7] = rev[8] = 0;
 
-	snprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
-		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |		/* Two 6-bit values */
+	scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
+		  (int)((sw_get_bits(buf, 8, 6, 1) << 6) |	/* Two 6-bit values */
 			sw_get_bits(buf, 16, 6, 1)) / 100,
-		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |
+		  (int)((sw_get_bits(buf, 8, 6, 1) << 6) |
 			sw_get_bits(buf, 16, 6, 1)) % 100,
-		 pnp, rev);
+		  pnp, rev);
 }
 
 /*
@@ -723,8 +723,8 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
 
 		snprintf(sw->name, sizeof(sw->name),
 			 "Microsoft SideWinder %s", sw_name[sw->type]);
-		snprintf(sw->phys[i], sizeof(sw->phys[i]),
-			 "%s/input%d", gameport->phys, i);
+		scnprintf(sw->phys[i], sizeof(sw->phys[i]),
+			  "%s/input%d", gameport->phys, i);
 
 		sw->dev[i] = input_dev = input_allocate_device();
 		if (!input_dev) {
-- 
2.43.0