[PATCH net-next] s390: ism: Pass string literal as format argument of dev_set_name()

[PATCH net-next] s390: ism: Pass string literal as format argument of dev_set_name()

[Simon Horman]

GCC 14.2.0 reports that passing a non-string literal as the
format argument of dev_set_name() is potentially insecure.

drivers/s390/net/ism_drv.c: In function 'ism_probe':
drivers/s390/net/ism_drv.c:615:2: warning: format not a string literal and no format arguments [-Wformat-security]
  615 |  dev_set_name(&ism->dev, dev_name(&pdev->dev));
      |  ^~~~~~~~~~~~

It seems to me that as pdev is a PCIE device then the dev_name
call above should always return the device's BDF, e.g. 00:12.0.
That this should not contain format escape sequences. And thus
the current usage is safe.

But, it seems better to be safe than sorry. And, as a bonus, compiler
output becomes less verbose by addressing this issue.

Compile tested only.
No functional change intended.

Signed-off-by: Simon Horman <horms@kernel.org>
---
 drivers/s390/net/ism_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index 60ed70a39d2c..b7f15f303ea2 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -611,7 +611,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	ism->dev.parent = &pdev->dev;
 	ism->dev.release = ism_dev_release;
 	device_initialize(&ism->dev);
-	dev_set_name(&ism->dev, dev_name(&pdev->dev));
+	dev_set_name(&ism->dev, "%s", dev_name(&pdev->dev));
 	ret = device_add(&ism->dev);
 	if (ret)
 		goto err_dev;

Re: [PATCH net-next] s390: ism: Pass string literal as format argument of dev_set_name()

[Heiko Carstens]

On Thu, Apr 17, 2025 at 11:28:23AM +0100, Simon Horman wrote:
> GCC 14.2.0 reports that passing a non-string literal as the
> format argument of dev_set_name() is potentially insecure.
> 
> drivers/s390/net/ism_drv.c: In function 'ism_probe':
> drivers/s390/net/ism_drv.c:615:2: warning: format not a string literal and no format arguments [-Wformat-security]
>   615 |  dev_set_name(&ism->dev, dev_name(&pdev->dev));
>       |  ^~~~~~~~~~~~
> 
> It seems to me that as pdev is a PCIE device then the dev_name
> call above should always return the device's BDF, e.g. 00:12.0.
> That this should not contain format escape sequences. And thus
> the current usage is safe.
> 
> But, it seems better to be safe than sorry. And, as a bonus, compiler
> output becomes less verbose by addressing this issue.
> 
> Compile tested only.
> No functional change intended.
> 
> Signed-off-by: Simon Horman <horms@kernel.org>
> ---
>  drivers/s390/net/ism_drv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

It might make sense to say that -Wformat-security was explicitly enabled in
order to trigger this (probably with KCFLAGS=-Wformat-security ?), since this
warning is by default disabled.

Just mentioning this, since I was wondering why I haven't seen this.

Re: [PATCH net-next] s390: ism: Pass string literal as format argument of dev_set_name()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 17 Apr 2025 11:28:23 +0100 you wrote:
> GCC 14.2.0 reports that passing a non-string literal as the
> format argument of dev_set_name() is potentially insecure.
> 
> drivers/s390/net/ism_drv.c: In function 'ism_probe':
> drivers/s390/net/ism_drv.c:615:2: warning: format not a string literal and no format arguments [-Wformat-security]
>   615 |  dev_set_name(&ism->dev, dev_name(&pdev->dev));
>       |  ^~~~~~~~~~~~
> 
> [...]

Here is the summary with links:
  - [net-next] s390: ism: Pass string literal as format argument of dev_set_name()
    https://git.kernel.org/netdev/net-next/c/199561a48f02

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net-next] s390: ism: Pass string literal as format argument of dev_set_name()

[Simon Horman]

On Thu, Apr 17, 2025 at 01:08:14PM +0200, Heiko Carstens wrote:
> On Thu, Apr 17, 2025 at 11:28:23AM +0100, Simon Horman wrote:
> > GCC 14.2.0 reports that passing a non-string literal as the
> > format argument of dev_set_name() is potentially insecure.
> > 
> > drivers/s390/net/ism_drv.c: In function 'ism_probe':
> > drivers/s390/net/ism_drv.c:615:2: warning: format not a string literal and no format arguments [-Wformat-security]
> >   615 |  dev_set_name(&ism->dev, dev_name(&pdev->dev));
> >       |  ^~~~~~~~~~~~
> > 
> > It seems to me that as pdev is a PCIE device then the dev_name
> > call above should always return the device's BDF, e.g. 00:12.0.
> > That this should not contain format escape sequences. And thus
> > the current usage is safe.
> > 
> > But, it seems better to be safe than sorry. And, as a bonus, compiler
> > output becomes less verbose by addressing this issue.
> > 
> > Compile tested only.
> > No functional change intended.
> > 
> > Signed-off-by: Simon Horman <horms@kernel.org>
> > ---
> >  drivers/s390/net/ism_drv.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> It might make sense to say that -Wformat-security was explicitly enabled in
> order to trigger this (probably with KCFLAGS=-Wformat-security ?), since this
> warning is by default disabled.
> 
> Just mentioning this, since I was wondering why I haven't seen this.

Thanks Heiko,

Yes, you are right on both counts. I should have mentioned this.
And I did compile with KCFLAGS=-Wformat-security.