[PATCH] net: alx: fix possible buffer overflow

Netdev List
 help / color / mirror / Atom feed

* [PATCH] net: alx: fix possible buffer overflow
@ 2026-05-20 18:01 Alexander A. Klimov
  2026-05-21  2:18 ` kernel test robot
  2026-05-21  4:29 ` kernel test robot
  0 siblings, 2 replies; 3+ messages in thread
From: Alexander A. Klimov @ 2026-05-20 18:01 UTC (permalink / raw)
  To: Chris Snook, Andrew Lunn, David S. Miller, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Kees Cook, Alexander A. Klimov,
	Tobias Regnery, open list:ATLX ETHERNET DRIVERS, open list

In alx_request_msix(), use snprintf(DST, sizeof(DST), ...)
and not sprintf(DST, ...) to never write more than sizeof(DST) bytes.

Fixes: e0eac2546090 ("alx: prepare interrupt functions for multiple queues")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/net/ethernet/atheros/alx/main.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index ab262e66f986..d2697d9eacfa 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -865,16 +865,17 @@ static int alx_request_msix(struct alx_priv *alx)
 		vector++;
 
 		if (np->txq && np->rxq)
-			sprintf(np->irq_lbl, "%s-TxRx-%u", netdev->name,
-				np->txq->queue_idx);
+			snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
+				 netdev->name, np->txq->queue_idx);
 		else if (np->txq)
-			sprintf(np->irq_lbl, "%s-tx-%u", netdev->name,
-				np->txq->queue_idx);
+			snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
+				 netdev->name, np->txq->queue_idx);
 		else if (np->rxq)
-			sprintf(np->irq_lbl, "%s-rx-%u", netdev->name,
-				np->rxq->queue_idx);
+			snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
+				 netdev->name, np->rxq->queue_idx);
 		else
-			sprintf(np->irq_lbl, "%s-unused", netdev->name);
+			snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
+				 netdev->name);
 
 		np->vec_idx = vector;
 		err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
-- 
2.54.0


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] net: alx: fix possible buffer overflow
  2026-05-20 18:01 [PATCH] net: alx: fix possible buffer overflow Alexander A. Klimov
@ 2026-05-21  2:18 ` kernel test robot
  2026-05-21  4:29 ` kernel test robot
  1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-05-21  2:18 UTC (permalink / raw)
  To: Alexander A. Klimov, Chris Snook, Andrew Lunn, David S. Miller,
	Eric Dumazet, Jakub Kicinski, Paolo Abeni, Kees Cook,
	Tobias Regnery, linux-kernel
  Cc: oe-kbuild-all, netdev

Hi Alexander,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v7.1-rc4 next-20260520]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Alexander-A-Klimov/net-alx-fix-possible-buffer-overflow/20260521-022058
base:   net-next/main
patch link:    https://lore.kernel.org/r/20260520180140.538826-1-grandmaster%40al2klimov.de
patch subject: [PATCH] net: alx: fix possible buffer overflow
config: x86_64-rhel-9.4-ltp (https://download.01.org/0day-ci/archive/20260521/202605211017.m1y6JlIV-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260521/202605211017.m1y6JlIV-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605211017.m1y6JlIV-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/net/ethernet/atheros/alx/main.c: In function 'alx_request_msix':
>> drivers/net/ethernet/atheros/alx/main.c:874:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
     874 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
         |                                                                             ^
   drivers/net/ethernet/atheros/alx/main.c:874:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
     874 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     875 |                                  netdev->name, np->rxq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/net/ethernet/atheros/alx/main.c:871:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
     871 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
         |                                                                             ^
   drivers/net/ethernet/atheros/alx/main.c:871:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
     871 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     872 |                                  netdev->name, np->txq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/atheros/alx/main.c:868:77: warning: '%u' directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 18 [-Wformat-truncation=]
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                                                                             ^~
   drivers/net/ethernet/atheros/alx/main.c:868:68: note: directive argument in the range [0, 65535]
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                                                                    ^~~~~~~~~~~~
   drivers/net/ethernet/atheros/alx/main.c:868:25: note: 'snprintf' output between 8 and 27 bytes into a destination of size 24
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     869 |                                  netdev->name, np->txq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +/snprintf +874 drivers/net/ethernet/atheros/alx/main.c

   851	
   852	static int alx_request_msix(struct alx_priv *alx)
   853	{
   854		struct net_device *netdev = alx->dev;
   855		int i, err, vector = 0, free_vector = 0;
   856	
   857		err = request_irq(pci_irq_vector(alx->hw.pdev, 0), alx_intr_msix_misc,
   858				  0, netdev->name, alx);
   859		if (err)
   860			goto out_err;
   861	
   862		for (i = 0; i < alx->num_napi; i++) {
   863			struct alx_napi *np = alx->qnapi[i];
   864	
   865			vector++;
   866	
   867			if (np->txq && np->rxq)
 > 868				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
   869					 netdev->name, np->txq->queue_idx);
   870			else if (np->txq)
   871				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
   872					 netdev->name, np->txq->queue_idx);
   873			else if (np->rxq)
 > 874				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
   875					 netdev->name, np->rxq->queue_idx);
   876			else
   877				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
   878					 netdev->name);
   879	
   880			np->vec_idx = vector;
   881			err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
   882					  alx_intr_msix_ring, 0, np->irq_lbl, np);
   883			if (err)
   884				goto out_free;
   885		}
   886		return 0;
   887	
   888	out_free:
   889		free_irq(pci_irq_vector(alx->hw.pdev, free_vector++), alx);
   890	
   891		vector--;
   892		for (i = 0; i < vector; i++)
   893			free_irq(pci_irq_vector(alx->hw.pdev,free_vector++),
   894				 alx->qnapi[i]);
   895	
   896	out_err:
   897		return err;
   898	}
   899	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] net: alx: fix possible buffer overflow
  2026-05-20 18:01 [PATCH] net: alx: fix possible buffer overflow Alexander A. Klimov
  2026-05-21  2:18 ` kernel test robot
@ 2026-05-21  4:29 ` kernel test robot
  1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-05-21  4:29 UTC (permalink / raw)
  To: Alexander A. Klimov, Chris Snook, Andrew Lunn, David S. Miller,
	Eric Dumazet, Jakub Kicinski, Paolo Abeni, Kees Cook,
	Tobias Regnery, linux-kernel
  Cc: oe-kbuild-all, netdev

Hi Alexander,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v7.1-rc4 next-20260520]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Alexander-A-Klimov/net-alx-fix-possible-buffer-overflow/20260521-022058
base:   net-next/main
patch link:    https://lore.kernel.org/r/20260520180140.538826-1-grandmaster%40al2klimov.de
patch subject: [PATCH] net: alx: fix possible buffer overflow
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260521/202605210628.C9sdnzRO-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260521/202605210628.C9sdnzRO-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605210628.C9sdnzRO-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/net/ethernet/atheros/alx/main.c: In function 'alx_request_msix':
>> drivers/net/ethernet/atheros/alx/main.c:874:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
     874 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
         |                                                                             ^
   drivers/net/ethernet/atheros/alx/main.c:874:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
     874 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     875 |                                  netdev->name, np->rxq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/net/ethernet/atheros/alx/main.c:871:77: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
     871 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
         |                                                                             ^
   drivers/net/ethernet/atheros/alx/main.c:871:25: note: 'snprintf' output between 6 and 25 bytes into a destination of size 24
     871 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     872 |                                  netdev->name, np->txq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/atheros/alx/main.c:868:77: warning: '%u' directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 18 [-Wformat-truncation=]
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                                                                             ^~
   drivers/net/ethernet/atheros/alx/main.c:868:68: note: directive argument in the range [0, 65535]
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                                                                    ^~~~~~~~~~~~
   drivers/net/ethernet/atheros/alx/main.c:868:25: note: 'snprintf' output between 8 and 27 bytes into a destination of size 24
     868 |                         snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     869 |                                  netdev->name, np->txq->queue_idx);
         |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +/snprintf +874 drivers/net/ethernet/atheros/alx/main.c

   851	
   852	static int alx_request_msix(struct alx_priv *alx)
   853	{
   854		struct net_device *netdev = alx->dev;
   855		int i, err, vector = 0, free_vector = 0;
   856	
   857		err = request_irq(pci_irq_vector(alx->hw.pdev, 0), alx_intr_msix_misc,
   858				  0, netdev->name, alx);
   859		if (err)
   860			goto out_err;
   861	
   862		for (i = 0; i < alx->num_napi; i++) {
   863			struct alx_napi *np = alx->qnapi[i];
   864	
   865			vector++;
   866	
   867			if (np->txq && np->rxq)
 > 868				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-TxRx-%u",
   869					 netdev->name, np->txq->queue_idx);
   870			else if (np->txq)
 > 871				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-tx-%u",
   872					 netdev->name, np->txq->queue_idx);
   873			else if (np->rxq)
 > 874				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-rx-%u",
   875					 netdev->name, np->rxq->queue_idx);
   876			else
   877				snprintf(np->irq_lbl, sizeof(np->irq_lbl), "%s-unused",
   878					 netdev->name);
   879	
   880			np->vec_idx = vector;
   881			err = request_irq(pci_irq_vector(alx->hw.pdev, vector),
   882					  alx_intr_msix_ring, 0, np->irq_lbl, np);
   883			if (err)
   884				goto out_free;
   885		}
   886		return 0;
   887	
   888	out_free:
   889		free_irq(pci_irq_vector(alx->hw.pdev, free_vector++), alx);
   890	
   891		vector--;
   892		for (i = 0; i < vector; i++)
   893			free_irq(pci_irq_vector(alx->hw.pdev,free_vector++),
   894				 alx->qnapi[i]);
   895	
   896	out_err:
   897		return err;
   898	}
   899	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2026-05-21  4:29 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-20 18:01 [PATCH] net: alx: fix possible buffer overflow Alexander A. Klimov
2026-05-21  2:18 ` kernel test robot
2026-05-21  4:29 ` kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox