Re: [PATCH] net: alx: fix possible buffer overflow

[kernel test robot <lkp@intel.com>]

Hi Alexander,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v7.1-rc4 next-20260520]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Alexander-A-Klimov/net-alx-fix-possible-buffer-overflow/20260521-022058
base:   net-next/main
patch link:    https://lore.kernel.org/r/20260520180140.538826-1-grandmaster%40al2klimov.de
patch subject: [PATCH] net: alx: fix possible buffer overflow
config: x86_64-rhel-9.4-ltp (https://download.01.org/0day-ci/archive/20260521/202605211017.m1y6JlIV-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260521/202605211017.m1y6JlIV-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605211017.m1y6JlIV-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/net/ethernet/atheros/alx/main.c: In function 'alx_request_msix':
>> drivers/net/ethernet/atheros/alx/main.c:874:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
     874 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
         |                                                                             ^
   drivers/net/ethernet/atheros/alx/main.c:874:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
     874 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     875 |                                  netdev->name, np->rxq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/net/ethernet/atheros/alx/main.c:871:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
     871 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
         |                                                                             ^
   drivers/net/ethernet/atheros/alx/main.c:871:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
     871 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     872 |                                  netdev->name, np->txq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/atheros/alx/main.c:868:77: warning: '%u' directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 18 [-Wformat-truncation=]
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                                                                             ^~
   drivers/net/ethernet/atheros/alx/main.c:868:68: note: directive argument in the range [0, 65535]
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                                                                    ^~~~~~~~~~~~
   drivers/net/ethernet/atheros/alx/main.c:868:25: note: 'snprintf' output between 8 and 27 bytes into a destination of size 24
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     869 |                                  netdev->name, np->txq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +/snprintf +874 drivers/net/ethernet/atheros/alx/main.c

   851	
   852	static int alx_request_msix(struct alx_priv *alx)
   853	{
   854		struct net_device *netdev = alx->dev;
   855		int i, err, vector = 0, free_vector = 0;
   856	
   857		err = request_irq(pci_irq_vector(alx->hw.pdev, 0), alx_intr_msix_misc,
   858				  0, netdev->name, alx);
   859		if (err)
   860			goto out_err;
   861	
   862		for (i = 0; i < alx->num_napi; i++) {
   863			struct alx_napi *np = alx->qnapi[i];
   864	
   865			vector++;
   866	
   867			if (np->txq && np->rxq)
 > 868				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
   869					 netdev->name, np->txq->queue_idx);
   870			else if (np->txq)
   871				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
   872					 netdev->name, np->txq->queue_idx);
   873			else if (np->rxq)
 > 874				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
   875					 netdev->name, np->rxq->queue_idx);
   876			else
   877				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
   878					 netdev->name);
   879	
   880			np->vec_idx = vector;
   881			err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
   882					  alx_intr_msix_ring, 0, np->irq_lbl, np);
   883			if (err)
   884				goto out_free;
   885		}
   886		return 0;
   887	
   888	out_free:
   889		free_irq(pci_irq_vector(alx->hw.pdev, free_vector++), alx);
   890	
   891		vector--;
   892		for (i = 0; i < vector; i++)
   893			free_irq(pci_irq_vector(alx->hw.pdev,free_vector++),
   894				 alx->qnapi[i]);
   895	
   896	out_err:
   897		return err;
   898	}
   899	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki