* [PATCH] net: alx: fix possible buffer overflow
@ 2026-05-20 18:01 Alexander A. Klimov
2026-05-21 2:18 ` kernel test robot
2026-05-21 4:29 ` kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Alexander A. Klimov @ 2026-05-20 18:01 UTC (permalink / raw)
To: Chris Snook, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Kees Cook, Alexander A. Klimov,
Tobias Regnery, open list:ATLX ETHERNET DRIVERS, open list
In alx_request_msix(), use snprintf(DST, sizeof(DST), ...)
and not sprintf(DST, ...) to never write more than sizeof(DST) bytes.
Fixes: e0eac2546090 ("alx: prepare interrupt functions for multiple queues")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
drivers/net/ethernet/atheros/alx/main.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index ab262e66f986..d2697d9eacfa 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -865,16 +865,17 @@ static int alx_request_msix(struct alx_priv *alx)
vector++;
if (np->txq && np->rxq)
- sprintf(np->irq_lbl, "%s-TxRx-%u", netdev->name,
- np->txq->queue_idx);
+ snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
+ netdev->name, np->txq->queue_idx);
else if (np->txq)
- sprintf(np->irq_lbl, "%s-tx-%u", netdev->name,
- np->txq->queue_idx);
+ snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
+ netdev->name, np->txq->queue_idx);
else if (np->rxq)
- sprintf(np->irq_lbl, "%s-rx-%u", netdev->name,
- np->rxq->queue_idx);
+ snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
+ netdev->name, np->rxq->queue_idx);
else
- sprintf(np->irq_lbl, "%s-unused", netdev->name);
+ snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
+ netdev->name);
np->vec_idx = vector;
err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
--
2.54.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] net: alx: fix possible buffer overflow
2026-05-20 18:01 [PATCH] net: alx: fix possible buffer overflow Alexander A. Klimov
@ 2026-05-21 2:18 ` kernel test robot
2026-05-21 4:29 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-05-21 2:18 UTC (permalink / raw)
To: Alexander A. Klimov, Chris Snook, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Kees Cook,
Tobias Regnery, linux-kernel
Cc: oe-kbuild-all, netdev
Hi Alexander,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v7.1-rc4 next-20260520]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Alexander-A-Klimov/net-alx-fix-possible-buffer-overflow/20260521-022058
base: net-next/main
patch link: https://lore.kernel.org/r/20260520180140.538826-1-grandmaster%40al2klimov.de
patch subject: [PATCH] net: alx: fix possible buffer overflow
config: x86_64-rhel-9.4-ltp (https://download.01.org/0day-ci/archive/20260521/202605211017.m1y6JlIV-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260521/202605211017.m1y6JlIV-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605211017.m1y6JlIV-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/net/ethernet/atheros/alx/main.c: In function 'alx_request_msix':
>> drivers/net/ethernet/atheros/alx/main.c:874:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
874 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
| ^
drivers/net/ethernet/atheros/alx/main.c:874:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
874 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
875 | netdev->name, np->rxq->queue_idx);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/atheros/alx/main.c:871:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
871 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
| ^
drivers/net/ethernet/atheros/alx/main.c:871:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
871 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
872 | netdev->name, np->txq->queue_idx);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/atheros/alx/main.c:868:77: warning: '%u' directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 18 [-Wformat-truncation=]
868 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
| ^~
drivers/net/ethernet/atheros/alx/main.c:868:68: note: directive argument in the range [0, 65535]
868 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
| ^~~~~~~~~~~~
drivers/net/ethernet/atheros/alx/main.c:868:25: note: 'snprintf' output between 8 and 27 bytes into a destination of size 24
868 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
869 | netdev->name, np->txq->queue_idx);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/snprintf +874 drivers/net/ethernet/atheros/alx/main.c
851
852 static int alx_request_msix(struct alx_priv *alx)
853 {
854 struct net_device *netdev = alx->dev;
855 int i, err, vector = 0, free_vector = 0;
856
857 err = request_irq(pci_irq_vector(alx->hw.pdev, 0), alx_intr_msix_misc,
858 0, netdev->name, alx);
859 if (err)
860 goto out_err;
861
862 for (i = 0; i < alx->num_napi; i++) {
863 struct alx_napi *np = alx->qnapi[i];
864
865 vector++;
866
867 if (np->txq && np->rxq)
> 868 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
869 netdev->name, np->txq->queue_idx);
870 else if (np->txq)
871 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
872 netdev->name, np->txq->queue_idx);
873 else if (np->rxq)
> 874 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
875 netdev->name, np->rxq->queue_idx);
876 else
877 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
878 netdev->name);
879
880 np->vec_idx = vector;
881 err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
882 alx_intr_msix_ring, 0, np->irq_lbl, np);
883 if (err)
884 goto out_free;
885 }
886 return 0;
887
888 out_free:
889 free_irq(pci_irq_vector(alx->hw.pdev, free_vector++), alx);
890
891 vector--;
892 for (i = 0; i < vector; i++)
893 free_irq(pci_irq_vector(alx->hw.pdev,free_vector++),
894 alx->qnapi[i]);
895
896 out_err:
897 return err;
898 }
899
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net: alx: fix possible buffer overflow
2026-05-20 18:01 [PATCH] net: alx: fix possible buffer overflow Alexander A. Klimov
2026-05-21 2:18 ` kernel test robot
@ 2026-05-21 4:29 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-05-21 4:29 UTC (permalink / raw)
To: Alexander A. Klimov, Chris Snook, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Kees Cook,
Tobias Regnery, linux-kernel
Cc: oe-kbuild-all, netdev
Hi Alexander,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v7.1-rc4 next-20260520]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Alexander-A-Klimov/net-alx-fix-possible-buffer-overflow/20260521-022058
base: net-next/main
patch link: https://lore.kernel.org/r/20260520180140.538826-1-grandmaster%40al2klimov.de
patch subject: [PATCH] net: alx: fix possible buffer overflow
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260521/202605210628.C9sdnzRO-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260521/202605210628.C9sdnzRO-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605210628.C9sdnzRO-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/net/ethernet/atheros/alx/main.c: In function 'alx_request_msix':
>> drivers/net/ethernet/atheros/alx/main.c:874:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
874 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
| ^
drivers/net/ethernet/atheros/alx/main.c:874:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
874 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
875 | netdev->name, np->rxq->queue_idx);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/atheros/alx/main.c:871:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
871 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
| ^
drivers/net/ethernet/atheros/alx/main.c:871:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
871 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
872 | netdev->name, np->txq->queue_idx);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/atheros/alx/main.c:868:77: warning: '%u' directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 18 [-Wformat-truncation=]
868 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
| ^~
drivers/net/ethernet/atheros/alx/main.c:868:68: note: directive argument in the range [0, 65535]
868 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
| ^~~~~~~~~~~~
drivers/net/ethernet/atheros/alx/main.c:868:25: note: 'snprintf' output between 8 and 27 bytes into a destination of size 24
868 | snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
869 | netdev->name, np->txq->queue_idx);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/snprintf +874 drivers/net/ethernet/atheros/alx/main.c
851
852 static int alx_request_msix(struct alx_priv *alx)
853 {
854 struct net_device *netdev = alx->dev;
855 int i, err, vector = 0, free_vector = 0;
856
857 err = request_irq(pci_irq_vector(alx->hw.pdev, 0), alx_intr_msix_misc,
858 0, netdev->name, alx);
859 if (err)
860 goto out_err;
861
862 for (i = 0; i < alx->num_napi; i++) {
863 struct alx_napi *np = alx->qnapi[i];
864
865 vector++;
866
867 if (np->txq && np->rxq)
> 868 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
869 netdev->name, np->txq->queue_idx);
870 else if (np->txq)
> 871 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
872 netdev->name, np->txq->queue_idx);
873 else if (np->rxq)
> 874 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
875 netdev->name, np->rxq->queue_idx);
876 else
877 snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
878 netdev->name);
879
880 np->vec_idx = vector;
881 err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
882 alx_intr_msix_ring, 0, np->irq_lbl, np);
883 if (err)
884 goto out_free;
885 }
886 return 0;
887
888 out_free:
889 free_irq(pci_irq_vector(alx->hw.pdev, free_vector++), alx);
890
891 vector--;
892 for (i = 0; i < vector; i++)
893 free_irq(pci_irq_vector(alx->hw.pdev,free_vector++),
894 alx->qnapi[i]);
895
896 out_err:
897 return err;
898 }
899
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-21 4:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-20 18:01 [PATCH] net: alx: fix possible buffer overflow Alexander A. Klimov
2026-05-21 2:18 ` kernel test robot
2026-05-21 4:29 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox