[PATCH] net: hns3: bound debugfs queue-name sprintf with scnprintf

[PATCH] net: hns3: bound debugfs queue-name sprintf with scnprintf

[Haoran Wang]

hns3_dbg_bd_file_init() builds one debugfs file name per queue with an
unbounded sprintf into a stack buffer.

    char name[HNS3_DBG_FILE_NAME_LEN];
    sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);

The only two table entries that reach this sprintf use the 11-char prefixes
"tx_bd_queue" and "rx_bd_queue".  i is a u16 loop index bounded by
max_queue_num = hns3_get_max_available_channels(handle), a
firmware-reported u16 with no kernel-side clamp on either the PF path
(le16 tqp_num, ext_tqp_num, pf_rss_size_max from the hclge config
command) or the VF mailbox path.  When firmware reports >= 10000
queues, i reaches five decimal digits and the write becomes

    11 (prefix) + 5 (digits) + 1 (NUL) = 17 > 16

so the NUL terminator lands one byte past the 16-byte stack buffer.

Replace sprintf with scnprintf(name, sizeof(name), ...) so the write is
bounded, guarding against a potential overflow.  Queue counts below
10000 are unaffected (no truncation); in the firmware-misreport case
the name is truncated instead of corrupting the stack.

Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
index 1347edac7..e186ec940 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -860,7 +860,7 @@ static int hns3_dbg_bd_file_init(struct hnae3_handle *handle, u32 cmd)
 		data[i].handle = handle;
 		data[i].cmd = hns3_dbg_cmd[cmd].cmd;
 		data[i].qid = i;
-		sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);
+		scnprintf(name, sizeof(name), "%s%u", hns3_dbg_cmd[cmd].name, i);
 		debugfs_create_file(name, 0400, entry_dir, &data[i],
 				    &hns3_dbg_bd_info_fops);
 	}

Re: [PATCH] net: hns3: bound debugfs queue-name sprintf with scnprintf

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net: hns3: bound debugfs queue-name sprintf with scnprintf

[Jijie Shao]

on 2026/10/19 21:22, Haoran Wang wrote:
> hns3_dbg_bd_file_init() builds one debugfs file name per queue with an
> unbounded sprintf into a stack buffer.
>
>      char name[HNS3_DBG_FILE_NAME_LEN];
>      sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);
>
> The only two table entries that reach this sprintf use the 11-char prefixes
> "tx_bd_queue" and "rx_bd_queue".  i is a u16 loop index bounded by
> max_queue_num = hns3_get_max_available_channels(handle), a
> firmware-reported u16 with no kernel-side clamp on either the PF path
> (le16 tqp_num, ext_tqp_num, pf_rss_size_max from the hclge config
> command) or the VF mailbox path.  When firmware reports >= 10000
> queues, i reaches five decimal digits and the write becomes
>
>      11 (prefix) + 5 (digits) + 1 (NUL) = 17 > 16
>
> so the NUL terminator lands one byte past the 16-byte stack buffer.
>
> Replace sprintf with scnprintf(name, sizeof(name), ...) so the write is
> bounded, guarding against a potential overflow.  Queue counts below
> 10000 are unaffected (no truncation); in the firmware-misreport case
> the name is truncated instead of corrupting the stack.

Thank you for the report.
However, the number of queues on our hardware will not exceed 10000,
and the driver trusts the queue count reported by firmware.
So this issue is not practically possible.

Thanks,
Jijie Shao


>
> Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>
> ---
>   drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c |    2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
> index 1347edac7..e186ec940 100644
> --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
> +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
> @@ -860,7 +860,7 @@ static int hns3_dbg_bd_file_init(struct hnae3_handle *handle, u32 cmd)
>   		data[i].handle = handle;
>   		data[i].cmd = hns3_dbg_cmd[cmd].cmd;
>   		data[i].qid = i;
> -		sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);
> +		scnprintf(name, sizeof(name), "%s%u", hns3_dbg_cmd[cmd].name, i);
>   		debugfs_create_file(name, 0400, entry_dir, &data[i],
>   				    &hns3_dbg_bd_info_fops);
>   	}