[PATCH v2] net: niu: fix potential buffer overflow/truncation in irq names

[PATCH v2] net: niu: fix potential buffer overflow/truncation in irq names

[Ronan Marchal]

Building with W=1 reports a -Wformat-truncation warning on
niu_set_irq_name(): the "%s:SYSERR" format could be truncated
because irq_name[] was one byte too small for the worst case
interface name length (IFNAMSIZ-1) plus the ":SYSERR" suffix.

Increase the irq_name buffer size to account for the suffix and
replace the remaining sprintf() calls in the same function with
snprintf() to avoid possible buffer overflows.

Tested:
- Built the kernel with W=1 and confirmed the warning is no longer reported.
- No NIU hardware was available for runtime testing.

Signed-off-by: Ronan Marchal <ronanmarchal29@gmail.com>
---
 drivers/net/ethernet/sun/niu.c | 6 +++---
 drivers/net/ethernet/sun/niu.h | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 88df15e6dd74..54dd7281191d 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -6021,11 +6021,11 @@ static void niu_set_irq_name(struct niu *np)
 	int port = np->port;
 	int i, j = 1;
 
-	sprintf(np->irq_name[0], "%s:MAC", np->dev->name);
+	snprintf(np->irq_name[0], sizeof(np->irq_name[0]), "%s:MAC", np->dev->name);
 
 	if (port == 0) {
-		sprintf(np->irq_name[1], "%s:MIF", np->dev->name);
-		sprintf(np->irq_name[2], "%s:SYSERR", np->dev->name);
+		snprintf(np->irq_name[1], sizeof(np->irq_name[1]), "%s:MIF", np->dev->name);
+		snprintf(np->irq_name[2], sizeof(np->irq_name[2]), "%s:SYSERR", np->dev->name);
 		j = 3;
 	}
 
diff --git a/drivers/net/ethernet/sun/niu.h b/drivers/net/ethernet/sun/niu.h
index d8368043fc3b..676d31499ac3 100644
--- a/drivers/net/ethernet/sun/niu.h
+++ b/drivers/net/ethernet/sun/niu.h
@@ -3262,7 +3262,7 @@ struct niu {
 #define NIU_FLAGS_XMAC			0x00010000 /* 0=BMAC 1=XMAC */
 
 	u32				msg_enable;
-	char                            irq_name[NIU_NUM_RXCHAN+NIU_NUM_TXCHAN+3][IFNAMSIZ + 6];
+	char                            irq_name[NIU_NUM_RXCHAN + NIU_NUM_TXCHAN + 3][IFNAMSIZ + 7];
 
 	/* Protects hw programming, and ring state.  */
 	spinlock_t			lock;
-- 
2.55.0

Re: [PATCH v2] net: niu: fix potential buffer overflow/truncation in irq names

[Simon Horman]

On Mon, Aug 03, 2026 at 11:11:49PM +0200, Ronan Marchal wrote:
> Building with W=1 reports a -Wformat-truncation warning on
> niu_set_irq_name(): the "%s:SYSERR" format could be truncated
> because irq_name[] was one byte too small for the worst case
> interface name length (IFNAMSIZ-1) plus the ":SYSERR" suffix.
> 
> Increase the irq_name buffer size to account for the suffix and
> replace the remaining sprintf() calls in the same function with
> snprintf() to avoid possible buffer overflows.
> 
> Tested:
> - Built the kernel with W=1 and confirmed the warning is no longer reported.
> - No NIU hardware was available for runtime testing.
> 
> Signed-off-by: Ronan Marchal <ronanmarchal29@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

FTR, I will list my feedback to the AI-generated review of this patch
available at
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260803211149.10585-1-ronanmarchal29%40gmail.com


1. -Wformat-overflow is the correct diagnostic rather than -Wformat-truncation

   Yes, I agree. But I don't think a respin is warranted only to address this.

2. Suggestion to add a fixes tag

   No, this is addresses a theoretical concern rather than a bug
   that manifests. It should not have a fixes tag.

3. Claim that not all sprintf() calls in the function have been updated as
   the commit message seems to claim.

   This appears to be true. But I don't think it warrants a respin.

Re: [PATCH v2] net: niu: fix potential buffer overflow/truncation in irq names

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  3 Aug 2026 23:11:49 +0200 you wrote:
> Building with W=1 reports a -Wformat-truncation warning on
> niu_set_irq_name(): the "%s:SYSERR" format could be truncated
> because irq_name[] was one byte too small for the worst case
> interface name length (IFNAMSIZ-1) plus the ":SYSERR" suffix.
> 
> Increase the irq_name buffer size to account for the suffix and
> replace the remaining sprintf() calls in the same function with
> snprintf() to avoid possible buffer overflows.
> 
> [...]

Here is the summary with links:
  - [v2] net: niu: fix potential buffer overflow/truncation in irq names
    https://git.kernel.org/netdev/net-next/c/4d8e0becfd34

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html