Re: [PATCH v3] PCI: dwc: Fix potential truncation in dw_pcie_edma_irq_verify()

[Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>]

On Sat, Jan 04, 2025 at 05:43:41AM +0100, Niklas Cassel wrote:
> On Sat, Jan 04, 2025 at 09:59:01AM +0530, Manivannan Sadhasivam wrote:
> > On Sat, Jan 04, 2025 at 01:21:20AM +0100, Niklas Cassel wrote:
> > > Increase the size of the string buffer to avoid potential truncation in
> > > dw_pcie_edma_irq_verify().
> > > 
> > > This fixes the following build warning when compiling with W=1:
> > > 
> > > drivers/pci/controller/dwc/pcie-designware.c: In function ‘dw_pcie_edma_detect’:
> > > drivers/pci/controller/dwc/pcie-designware.c:989:50: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Wformat-truncation=]
> > >   989 |                 snprintf(name, sizeof(name), "dma%d", pci->edma.nr_irqs);
> > >       |                                                  ^~
> > > 
> > > Signed-off-by: Niklas Cassel <cassel@kernel.org>
> > > ---
> > > Changes since v2:
> > > -Simply increase the size of the string buffer instead of chaning the
> > >  print format specifier.
> > > 
> > >  drivers/pci/controller/dwc/pcie-designware.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
> > > index 3c683b6119c3..145e7f579072 100644
> > > --- a/drivers/pci/controller/dwc/pcie-designware.c
> > > +++ b/drivers/pci/controller/dwc/pcie-designware.c
> > > @@ -971,7 +971,7 @@ static int dw_pcie_edma_irq_verify(struct dw_pcie *pci)
> > >  {
> > >  	struct platform_device *pdev = to_platform_device(pci->dev);
> > >  	u16 ch_cnt = pci->edma.ll_wr_cnt + pci->edma.ll_rd_cnt;
> > > -	char name[6];
> > > +	char name[15];
> > 
> > Isn't 14 big enough to hold INT_MAX + 'dma'? Not a big deal, but asking just for
> > the sake of correctness.
> 
> We need to be able to hold INT_MIN which is "-2147483648" 11 chars/bytes
> + "dma" 3 chars/bytes + terminating null byte (1 char/byte) = 15.
> 

Ah, brain fade (missing the null byte termination).

Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

- Mani

-- 
மணிவண்ணன் சதாசிவம்